# API authentication methods
Source: https://docs.kosli.com/administration/authentication/api_authentication_methods

How to authenticate to the Kosli API using bearer tokens or HTTP basic auth.

The Kosli API supports two authentication methods:

| Method                              | Status          | When to use                                                            |
| ----------------------------------- | --------------- | ---------------------------------------------------------------------- |
| [Bearer token](#bearer-token)       | **Recommended** | All new integrations. Works for service account and personal API keys. |
| [HTTP basic auth](#http-basic-auth) | Legacy          | Fallback for tools that cannot send an `Authorization: Bearer` header. |

<Tip>
  If you are integrating Kosli for the first time, use bearer tokens. Basic auth remains supported for backwards compatibility but is not the recommended path.
</Tip>

## Bearer token

Bearer tokens work with both [service account](/administration/authentication/service_accounts) and [personal](/user/personal_api_keys) API keys.

### In the CLI

Pass the token to any `kosli` command using one of:

* The `--api-token` flag.
* The `KOSLI_API_TOKEN` environment variable.
* A config file passed via `--config-file` — see [Assigning flags via config files](/getting_started/install#assigning-flags-via-config-files).

### In API requests

Send the token in the `Authorization` header:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
curl -H "Authorization: Bearer <<your-api-key>>" \
  https://app.kosli.com/api/v2/environments/<<your-org-name>>
```

## HTTP basic auth

<Note>
  HTTP basic auth is a legacy method kept for backwards compatibility with tools that cannot send an `Authorization: Bearer` header. For all new integrations, use bearer tokens instead.
</Note>

Kosli accepts HTTP basic auth as an alternative to bearer tokens. The API key is sent as the **username**; the password is ignored.

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
curl -u "<<your-api-key>>:" \
  https://app.kosli.com/api/v2/environments/<<your-org-name>>
```

<Warning>
  The trailing colon (`:`) is required. Without it, `curl` treats the whole string as a username with no password and **prompts interactively** for one — at which point the API key may already be visible in the prompt or shell history (especially when the key comes from an environment variable). The value after the colon can be anything, including empty; Kosli ignores it.
</Warning>

Equivalently, set the `Authorization` header directly with the base64-encoded `<<your-api-key>>:` string:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
curl -H "Authorization: Basic $(printf '%s:' "<<your-api-key>>" | base64)" \
  https://app.kosli.com/api/v2/environments/<<your-org-name>>
```


# API key rotation
Source: https://docs.kosli.com/administration/authentication/api_key_rotation

Reference for how Kosli API key rotation works, including grace periods and the rotation API.

Rotating API keys regularly limits the blast radius of a leaked credential. Kosli supports **zero-downtime rotation** for service account API keys: a new key is issued immediately while the old key remains valid for a configurable grace period.

## How rotation works

When you rotate a service account API key, Kosli:

1. Generates a new API key and returns its value once.
2. Keeps the old key valid for a configurable grace period (default: **24 hours**).
3. Automatically revokes the old key when the grace period expires.

Choose a grace period that fits your deployment cadence — long enough to roll the new key out to every consumer, short enough to limit exposure.

## Where next

* [Rotating API keys (tutorial)](/tutorials/rotating_api_keys) — step-by-step walkthrough in the web app and via the API.
* [Service accounts](/administration/authentication/service_accounts) — service account lifecycle.
* [Rotate an API key (API reference)](/api-reference/service-accounts/rotate-an-api-key-for-a-service-account)
* [Revoke an API key (API reference)](/api-reference/service-accounts/revoke-an-api-key-for-a-service-account)
* [List API keys (API reference)](/api-reference/service-accounts/list-api-keys-for-a-service-account)


# Service accounts
Source: https://docs.kosli.com/administration/authentication/service_accounts

Create and manage service accounts and their API keys for machine-to-machine access to Kosli.

A **service account** is a machine user. Use service accounts for any non-human caller — CI pipelines, runtime reporters, scripts, and other automation — so that credentials and audit trails are tied to a system rather than a person.

<Warning>
  Service accounts are only available in shared organizations.
</Warning>

## Create a service account

<Steps>
  <Step title="Open the organization's settings">
    Sign in to Kosli and select the organization where the service account should live.
    Navigate to **Settings → Service accounts**.
  </Step>

  <Step title="Add the service account">
    Click **Add new service account**, give it a descriptive name (e.g. `ci-github-actions`), and click **Add**.
  </Step>

  <Step title="Generate an API key">
    On the new service account, click **Add API key**. Choose a Time-To-Live (TTL), add a label that identifies where the key will be used, and click **Add**.
  </Step>

  <Step title="Copy the key immediately">
    Kosli stores only a cryptographic hash of the token. The original value is shown once and cannot be retrieved later — paste it directly into your secret store.
  </Step>
</Steps>

## Assign a role

Service accounts have the same role model as users: **Admin**, **Member**, **Snapshotter**, or **Reader**. The role determines what the service account can do in the organization. Pick the least-privileged role that fits the workload.

See [Roles in Kosli](/administration/managing_users/roles_in_kosli) for the full permissions matrix. As a starting point:

* **Member** — CI/CD systems that report attestations, manage flows, and create resources.
* **Snapshotter** — runtime reporters that record environment snapshots and create environments (for example, CLI callers using `--auto-environment`).
* **Reader** — read-only systems such as dashboards or query tooling.
* **Admin** — rarely needed; reserve for automation that manages users, roles, or organization-wide settings (for example, Terraform-driven org bootstrap).

## Rotate or revoke keys

For zero-downtime rotation and the API-driven flow, see:

* [API key rotation (reference)](/administration/authentication/api_key_rotation)
* [Rotating API keys (tutorial)](/tutorials/rotating_api_keys)


# Managing Custom Attestation Types
Source: https://docs.kosli.com/administration/managing_custom_attestation_types/overview

Learn how to manage Kosli custom attestation types via Terraform, including creating and importing types with JSON Schema and jq evaluation rules.

The preferred way to manage custom attestation types is via the <Tooltip href="https://registry.terraform.io/providers/kosli-dev/kosli/latest/docs/">Kosli Terraform provider</Tooltip>, so your Kosli configuration is version-controlled alongside your infrastructure. You can also manage custom attestation types through the Kosli CLI.

<Info>
  This page covers managing custom attestation types via Terraform. For an introduction to custom attestation types and creating them via the CLI, see [Getting started: Attestations](/getting_started/attestations).
</Info>

Custom attestation types define how Kosli validates evidence from tools that don't have a built-in Kosli attestation command. Each type can include:

* A **JSON Schema** (optional) that defines the expected structure of attestation data
* **jq rules** (optional) that evaluate the data to determine compliance

At least one of the two must be provided.

## Create a custom attestation type

### With schema and jq rules

```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
resource "kosli_custom_attestation_type" "security_scan" {
  name        = "security-scan"
  description = "Validates security scan results"

  schema = jsonencode({
    type = "object"
    properties = {
      critical_vulnerabilities = { type = "integer" }
      high_vulnerabilities     = { type = "integer" }
      scan_date                = { type = "string" }
    }
    required = ["critical_vulnerabilities", "high_vulnerabilities", "scan_date"]
  })

  jq_rules = [
    ".critical_vulnerabilities == 0",
    ".high_vulnerabilities < 5"
  ]
}
```

### With jq rules only

```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
resource "kosli_custom_attestation_type" "code_coverage" {
  name        = "code-coverage"
  description = "Requires at least 80% line coverage"

  jq_rules = [".line_coverage >= 80"]
}
```

### With schema only

```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
resource "kosli_custom_attestation_type" "deployment_record" {
  name        = "deployment-record"
  description = "Validates deployment record structure"

  schema = jsonencode({
    type = "object"
    properties = {
      deployed_by = { type = "string" }
      deployed_at = { type = "string" }
      environment = { type = "string" }
    }
    required = ["deployed_by", "deployed_at", "environment"]
  })
}
```

## Import an existing custom attestation type

If you have custom attestation types created via the CLI, you can bring them under Terraform management by importing them into your <Tooltip>Terraform state</Tooltip>.

1. Find the attestation type name in the Kosli UI or run:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list attestation-types
```

2. Add a matching `kosli_custom_attestation_type` resource block to your configuration.

3. Run the import:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform import kosli_custom_attestation_type.security_scan security-scan
```

4. Verify with `terraform plan` — no changes should be planned if the import succeeded.

## Reference

* [`kosli_custom_attestation_type` resource](/terraform-reference/resources/custom_attestation_type)
* [`kosli_custom_attestation_type` data source](/terraform-reference/data-sources/custom_attestation_type)
* [Kosli Terraform provider on the Terraform Registry](https://registry.terraform.io/providers/kosli-dev/kosli/latest)


# Managing Environments
Source: https://docs.kosli.com/administration/managing_environments/overview

Learn how to manage Kosli environments via Terraform, including creating and importing physical and logical environments.

<Note>
  Archiving environments requires the Admin role.
</Note>

The preferred way to manage environments is via the <Tooltip href="https://registry.terraform.io/providers/kosli-dev/kosli/latest/docs/">Kosli Terraform provider</Tooltip>, so your Kosli configuration is version-controlled alongside your infrastructure. You can also manage environments through the Kosli CLI or UI.

<Info>
  This page covers managing environments via Terraform. For creating environments via the CLI or UI, see [Getting started: Environments](/getting_started/environments).
</Info>

Kosli has two environment types:

* **<Tooltip>Physical environments</Tooltip>** — each maps to a single runtime (e.g. a Kubernetes cluster or ECS service). Managed with the `kosli_environment` resource.
* **<Tooltip>Logical environments</Tooltip>** — aggregate one or more physical environments into a single view. Managed with the `kosli_logical_environment` resource.

## Managing physical environments

### Create a physical environment

```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
resource "kosli_environment" "production" {
  name        = "production-k8s"
  description = "Production Kubernetes cluster"
  type        = "K8S"
}
```

Supported types: `K8S`, `ECS`, `S3`, `docker`, `server`, `lambda`.

### Import an existing physical environment

If you have environments created via the UI or CLI, you can bring them under Terraform management by importing them into your <Tooltip>Terraform state</Tooltip>.

1. Find the environment name in the Kosli UI under **Environments**, or run:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list environments
```

2. Add a matching `kosli_environment` resource block to your configuration:

```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
resource "kosli_environment" "my_environment" {
  name        = "production"
  description = "Production environment"
  type        = "K8S"  # must match the existing environment's type
}
```

3. Run the import:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform import kosli_environment.my_environment production
```

4. Verify with `terraform plan` — no changes should be planned if the import succeeded.

<Warning>
  The `type` in your Terraform configuration must exactly match the type of the existing environment in Kosli. A mismatch will cause import errors or misconfiguration.
</Warning>

## Managing logical environments

Logical environments group physical environments into a combined view — useful for representing a full production tier across multiple runtimes.

### Create a logical environment

```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
resource "kosli_logical_environment" "production_all" {
  name                  = "production-all"
  description           = "All production environments"
  included_environments = ["production-k8s", "production-ecs", "production-lambda"]
}
```

`included_environments` must reference the names of existing physical environments. Logical environments cannot include other logical environments.

### Import an existing logical environment

1. Find the logical environment name:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list environments
```

2. Add a matching `kosli_logical_environment` resource block:

```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
resource "kosli_logical_environment" "production_all" {
  name                  = "production-all"
  included_environments = ["production-k8s", "production-ecs"]
}
```

3. Run the import:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform import kosli_logical_environment.production_all production-all
```

4. Verify with `terraform plan` — no changes should be planned if the import succeeded.

## Reference

* [`kosli_environment` resource](/terraform-reference/resources/environment)
* [`kosli_environment` data source](/terraform-reference/data-sources/environment)
* [`kosli_logical_environment` resource](/terraform-reference/resources/logical_environment)
* [`kosli_logical_environment` data source](/terraform-reference/data-sources/logical_environment)


# Managing Tags
Source: https://docs.kosli.com/administration/managing_tags

Use tags to label and organize Kosli resources with custom key-value pairs via Terraform, CLI, or API.

Tags are custom key-value pairs you attach to Kosli resources. They let you categorize, filter, and add metadata to your flows and environments without changing the resources themselves.

## Why use tags

* **Organize resources** — group related flows or environments by team, project, region, or any other dimension.
* **Drive policy behavior** — reference tags in [Environment Policy](/getting_started/policies) expressions to make attestation requirements conditional. For example, require security scans only for flows tagged `risk-level=high`.
* **Add operational metadata** — store context such as cost center, service tier, or owner directly on the resource.

## Supported resources

You can tag the following Kosli resource types:

| Resource type | Terraform resource                                                | CLI identifier |
| :------------ | :---------------------------------------------------------------- | :------------- |
| Flow          | [`kosli_flow`](/terraform-reference/resources/flow)               | `flow`         |
| Environment   | [`kosli_environment`](/terraform-reference/resources/environment) | `env`          |

## Tag key and value rules

* **Keys** must start with a letter or digit and can contain letters, digits, hyphens (`-`), underscores (`_`), dots (`.`), and tildes (`~`).
* **Values** are strings. If a value is a valid URL (e.g. `https://example.com`), Kosli automatically renders it as a clickable link in the UI.
* There is no fixed limit on the number of tags per resource, but keep them concise for readability.

## Add or update tags

<Tabs>
  <Tab title="Terraform" icon="cubes">
    Add a `tags` map to any `kosli_environment` or `kosli_flow` resource. Tags are applied via a diff — only changed tags are sent to the API.

    Tag an environment:

    ```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    resource "kosli_environment" "production" {
      name        = "production-k8s"
      type        = "K8S"
      description = "Production Kubernetes cluster"
      tags = {
        region     = "eu-west-1"
        tier       = "critical"
        managed-by = "platform-team"
      }
    }
    ```

    Tag a flow:

    ```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    resource "kosli_flow" "api_service" {
      name        = "api-service"
      description = "API service pipeline"
      tags = {
        team       = "platform"
        risk-level = "high"
      }
    }
    ```

    See the [`kosli_environment` resource](/terraform-reference/resources/environment) and [`kosli_flow` resource](/terraform-reference/resources/flow) for the full schema.
  </Tab>

  <Tab title="CLI" icon="terminal">
    Pass one or more `--set` flags with `key=value` pairs. If a key already exists, its value is updated:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag flow my-flow \
      --set team=platform \
      --set risk-level=high
    ```

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag env production \
      --set region=eu-west-1 \
      --set tier=critical
    ```

    See [`kosli tag`](/client_reference/kosli_tag) for all flags and options.
  </Tab>

  <Tab title="API" icon="code">
    Use the tags endpoint with `set_tags`:

    <CodeGroup>
      ```shell EU theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      curl -X PATCH "https://app.kosli.com/api/v2/tags/{org}/flow/my-flow" \
        -H "Authorization: Bearer $KOSLI_API_TOKEN" \
        -H "Content-Type: application/json" \
        -d '{
          "set_tags": {"team": "platform", "risk-level": "high"}
        }'
      ```

      ```shell US theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      curl -X PATCH "https://app.us.kosli.com/api/v2/tags/{org}/flow/my-flow" \
        -H "Authorization: Bearer $KOSLI_API_TOKEN" \
        -H "Content-Type: application/json" \
        -d '{
          "set_tags": {"team": "platform", "risk-level": "high"}
        }'
      ```
    </CodeGroup>
  </Tab>
</Tabs>

## Remove tags

<Tabs>
  <Tab title="Terraform" icon="cubes">
    Remove individual tags by deleting them from the `tags` map. Set `tags = {}` to remove all tags:

    ```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    resource "kosli_environment" "production" {
      name = "production-k8s"
      type = "K8S"
      tags = {}
    }
    ```
  </Tab>

  <Tab title="CLI" icon="terminal">
    Pass one or more `--unset` flags with the keys to remove:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag env production \
      --unset region
    ```
  </Tab>

  <Tab title="API" icon="code">
    Use the tags endpoint with `remove_tags`:

    <CodeGroup>
      ```shell EU theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      curl -X PATCH "https://app.kosli.com/api/v2/tags/{org}/env/production" \
        -H "Authorization: Bearer $KOSLI_API_TOKEN" \
        -H "Content-Type: application/json" \
        -d '{
          "remove_tags": ["region"]
        }'
      ```

      ```shell US theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      curl -X PATCH "https://app.us.kosli.com/api/v2/tags/{org}/env/production" \
        -H "Authorization: Bearer $KOSLI_API_TOKEN" \
        -H "Content-Type: application/json" \
        -d '{
          "remove_tags": ["region"]
        }'
      ```
    </CodeGroup>
  </Tab>
</Tabs>

## Read tags

<Tabs>
  <Tab title="Terraform" icon="cubes">
    Use data sources to read tags from existing resources:

    ```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    data "kosli_environment" "production" {
      name = "production-k8s"
    }

    output "production_tags" {
      value = data.kosli_environment.production.tags
    }

    output "managed_by" {
      value = try(data.kosli_environment.production.tags["managed-by"], "unknown")
    }
    ```
  </Tab>

  <Tab title="API" icon="code">
    Tags are included in the resource response when you fetch an environment or flow via the API.
  </Tab>
</Tabs>

## Recommended tag patterns

A consistent tagging strategy makes it easier to organize resources as your Kosli usage grows. Here are common patterns:

| Tag key       | Example values                   | Purpose                           |
| :------------ | :------------------------------- | :-------------------------------- |
| `tier`        | `dev`, `staging`, `prod`         | Distinguish environment stages    |
| `team`        | `platform`, `payments`, `mobile` | Identify the owning team          |
| `region`      | `eu-west-1`, `us-east-1`         | Track geographic location         |
| `risk-level`  | `high`, `medium`, `low`          | Drive conditional policy behavior |
| `cost-center` | `eng-1234`, `ops-5678`           | Map to internal accounting        |

<Tip>
  Pick a small set of tag keys and document them for your organization. Consistent keys across environments and flows make filtering and policy expressions predictable.
</Tip>

### Example: categorizing environments by stage

Tag your environments to reflect their deployment stage. This lets you quickly identify which environments are production-critical and apply policies accordingly:

<Tabs>
  <Tab title="Terraform" icon="cubes">
    ```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    resource "kosli_environment" "staging_k8s" {
      name        = "staging-k8s"
      type        = "K8S"
      description = "Staging Kubernetes cluster"
      tags = {
        tier   = "staging"
        team   = "platform"
        region = "eu-west-1"
      }
    }

    resource "kosli_environment" "production_k8s" {
      name        = "production-k8s"
      type        = "K8S"
      description = "Production Kubernetes cluster"
      tags = {
        tier   = "prod"
        team   = "platform"
        region = "eu-west-1"
      }
    }
    ```
  </Tab>

  <Tab title="CLI" icon="terminal">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag env staging-k8s \
      --set tier=staging \
      --set team=platform \
      --set region=eu-west-1
    ```

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag env production-k8s \
      --set tier=prod \
      --set team=platform \
      --set region=eu-west-1
    ```
  </Tab>
</Tabs>

## Using tags in policies

Tags become powerful when combined with [Environment Policies](/getting_started/policies). You can reference flow tags in policy expressions to conditionally require attestations:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
attestations:
  - if: ${{ flow.tags.risk-level == "high" }}
    name: security-scan
    type: snyk
```

In this example, the `security-scan` attestation is only required when the flow is tagged with `risk-level=high`. This lets you enforce stricter compliance for high-risk services while keeping lighter requirements for lower-risk ones.

For the full expression syntax, see the [Environment Policy reference](/policy-reference/environment_policy).


# Mapping users to roles
Source: https://docs.kosli.com/administration/managing_users/mapping_users_to_roles

Recommended mappings from common organizational roles to Kosli roles.

When implementing Kosli, you need to map organizational roles to [Kosli roles](/administration/managing_users/roles_in_kosli). This table provides recommended mappings based on typical responsibilities:

| Organizational Role        | Recommended Kosli Role | Alternative            | Rationale                                                                                                                                                                                                                                      |
| -------------------------- | ---------------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Platform Engineers**     | Member                 | Admin (for leads)      | Platform engineers need to set up flows, manage service accounts, configure integrations, and implement Kosli across teams. Member role provides these capabilities. Lead platform engineers managing the overall setup may need Admin access. |
| **Application Developers** | Member                 | Reader (for view-only) | Developers typically need to report attestations and manage flows for their applications. Member role enables this. Some developers may only need visibility into deployments and compliance status, making Reader sufficient.                 |
| **Security & Compliance**  | Admin                  | N/A                    | Security and compliance teams need to manage policies, review audit data, control user access, and configure organization-wide settings. Admin role is required for these governance responsibilities.                                         |
| **Sponsors**               | Reader                 | N/A                    | Sponsors need visibility into adoption progress, compliance status, and overall system health but don't need to make technical changes. Reader role provides necessary oversight without operational access.                                   |

## Understanding the mapping

This mapping is a starting point. Your organization's structure and responsibilities may require adjustments:

* **Small teams**: Developers might need Admin access if they handle all aspects
* **Large enterprises**: Strict separation may require more Readers, fewer Admins
* **Regulated industries**: Security teams might need dedicated Admin accounts separate from operations

The key principle: Assign the minimum role required for someone to fulfill their responsibilities effectively.

## Learn more about organizational roles

For detailed guidance on each organizational role's responsibilities during Kosli implementation, see:

* [Implementation Guide: Roles and Responsibilities](/implementation_guide/phase_1/roles_and_responsibilities/overview)
* [Platform Engineers](/implementation_guide/phase_1/roles_and_responsibilities/platform_engineers)
* [Application Developers](/implementation_guide/phase_1/roles_and_responsibilities/app_developers)
* [Security & Compliance](/implementation_guide/phase_1/roles_and_responsibilities/security_compliance)
* [Sponsors](/implementation_guide/phase_1/roles_and_responsibilities/sponsors)


# Roles in Kosli
Source: https://docs.kosli.com/administration/managing_users/roles_in_kosli

Understand the roles in Kosli and their permissions to manage access for users and service accounts within your organization.

Kosli uses a single role model that applies to both **users** and **[service accounts](/administration/authentication/service_accounts)**. Understanding these roles is essential for assigning the appropriate level of access to your team members and to the automated systems that talk to Kosli on their behalf.

<Note>
  Roles apply to service accounts the same way they apply to users. Wherever this page mentions a "user", read it as "user or service account" unless explicitly stated otherwise. The only role-related capability that is user-only is being invited to or removed from the organization.
</Note>

## Overview

| Role            | Description                                                               | Best for                                                        |
| --------------- | ------------------------------------------------------------------------- | --------------------------------------------------------------- |
| **Admin**       | Full control over the organization                                        | Organization owners, security leads, platform engineering leads |
| **Member**      | Can create and modify resources                                           | Developers, platform engineers, CI/CD systems                   |
| **Snapshotter** | Can create snapshots, environments, and manage their own service accounts | Environment and operations teams                                |
| **Reader**      | Read-only access to view data                                             | Auditors, compliance officers, stakeholders, reporting systems  |

## Permissions Matrix

| Capability                                                           | Admin | Member | Snapshotter | Reader |
| -------------------------------------------------------------------- | :---: | :----: | :---------: | :----: |
| **User Management**                                                  |       |        |             |        |
| Invite and remove users                                              |   ✅   |    ❌   |      ❌      |    ❌   |
| Change user roles                                                    |   ✅   |    ❌   |      ❌      |    ❌   |
| **Organization Settings**                                            |       |        |             |        |
| Modify organization settings                                         |   ✅   |    ❌   |      ❌      |    ❌   |
| Configure integrations (Slack, LaunchDarkly)                         |   ✅   |    ✅   |      ❌      |    ❌   |
| **Service Accounts**                                                 |       |        |             |        |
| Create and manage service accounts                                   |   ✅   |    ✅   |      ✅      |    ❌   |
| Generate service account API keys                                    |   ✅   |    ✅   |      ✅      |    ❌   |
| **Resource Management**                                              |       |        |             |        |
| Create flows                                                         |   ✅   |    ✅   |      ❌      |    ❌   |
| Update/delete flows                                                  |   ✅   |    ✅   |      ❌      |    ❌   |
| Create environments (and re-create)                                  |   ✅   |    ✅   |      ✅      |    ❌   |
| Update environments (PATCH, archive, rename, attach/detach policies) |   ✅   |    ✅   |      ❌      |    ❌   |
| Delete environments                                                  |   ✅   |    ❌   |      ❌      |    ❌   |
| Create/update policies                                               |   ✅   |    ✅   |      ❌      |    ❌   |
| Delete policies                                                      |   ❌   |    ❌   |      ❌      |    ❌   |
| Create attestation types                                             |   ✅   |    ✅   |      ❌      |    ❌   |
| Update/delete attestation types                                      |   ✅   |    ✅   |      ❌      |    ❌   |
| **Attestations & Snapshots**                                         |       |        |             |        |
| Report attestations                                                  |   ✅   |    ✅   |      ❌      |    ❌   |
| Report environment snapshots                                         |   ✅   |    ✅   |      ✅      |    ❌   |
| **Actions**                                                          |       |        |             |        |
| Create, update, and delete actions                                   |   ✅   |    ✅   |      ❌      |    ❌   |
| View actions                                                         |   ✅   |    ✅   |      ✅      |    ✅   |
| **Data Access**                                                      |       |        |             |        |
| View trails and artifacts                                            |   ✅   |    ✅   |      ✅      |    ✅   |
| View attestations                                                    |   ✅   |    ✅   |      ✅      |    ✅   |
| View snapshots                                                       |   ✅   |    ✅   |      ✅      |    ✅   |
| Query and search data                                                |   ✅   |    ✅   |      ✅      |    ✅   |
| Export and generate reports                                          |   ✅   |    ✅   |      ✅      |    ✅   |
| View flow/policy configurations                                      |   ✅   |    ✅   |      ✅      |    ✅   |

***

## Role details

The following sections provide more details about each Kosli user role, including their permissions and when to assign them.

<Accordion title="Admin" icon="shield-check">
  Administrators have full control over the organization and its resources.

  ### Permissions

  Admins can perform all actions in Kosli, including:

  * **User Management**: Invite, remove, and change roles of organization members (Admin only)
  * **Organization Settings**: Modify organization-wide settings and configurations (Admin only)
  * **Service Accounts**: Create and manage service accounts and their API keys
  * **Integrations**: Configure integrations with external systems (Slack, LaunchDarkly, etc.)
  * **Resource Management**: Create, update, and delete flows, environments, policies, and attestation types
  * **Attestations & Snapshots**: Report attestations and environment snapshots
  * **Actions**: Create, update, and delete actions for automated workflows and notifications
  * **Data Access**: View all trails, artifacts, attestations, and snapshots

  ### When to assign

  Assign the Admin role to:

  * Organization owners or senior leaders responsible for overall Kosli implementation
  * Security engineers who need to manage user access and compliance processes
  * Platform engineering leads who need to configure integrations and manage organization settings

  <Warning>
    Limit the number of Admins to maintain security and control over your organization. Most users should be Members or Readers.
  </Warning>
</Accordion>

<Accordion title="Member" icon="user-check">
  Members can create and modify resources, manage service accounts, and configure integrations, but cannot manage users or organization-wide settings.

  ### Permissions

  Members can:

  * **Service Accounts**: Create and manage service accounts and their API keys
  * **Integrations**: Configure integrations with external systems (Slack, LaunchDarkly, etc.)
  * **Resource Management**: Create, update, and delete flows, environments, policies, and attestation types
  * **Attestations & Snapshots**: Report attestations and environment snapshots
  * **Actions**: Create, update, and delete actions for automated workflows and notifications
  * **Data Access**: View all trails, artifacts, attestations, and snapshots

  Members cannot:

  * Manage users or change user roles
  * Modify organization-wide settings

  ### When to assign

  Assign the Member role to:

  * Platform engineers who need to implement Kosli across teams and manage service accounts
  * Application developers who need to report attestations and manage flows
  * Team leads who need to configure integrations and create service accounts for their teams
  * CI/CD systems that need to report attestations and snapshots (via service accounts)
</Accordion>

<Accordion title="Snapshotter" icon="camera">
  Snapshotters can create environments, report environment snapshots, and manage their own service accounts, but cannot modify other resources, manage users, configure integrations, or change organization-wide settings.

  ### Permissions

  Snapshotters can:

  * **Service Accounts**: Create service accounts. They can manage the API keys of service accounts they created themselves — API keys on other service accounts can only be managed by the account's creator or an org Admin.
  * **Environments**: Create new environments (needed so CLI flows like `--auto-environment` work with a snapshotter token).
  * **Snapshots**: Report environment snapshots.
  * **View Data**: Access trails, artifacts, attestations, and snapshots.
  * **Query Information**: Search and filter data across flows and environments.
  * **Generate Reports**: Export and analyze compliance data.
  * **View Configurations**: See flow definitions, policies, attestation types, and actions (but cannot modify them).

  Snapshotters cannot:

  * Use the dedicated update paths on an environment (PATCH, archive, rename, attach/detach policies).
  * Create, update, or delete flows, policies, attestation types, or other resources.
  * Report attestations.
  * Create or manage actions.
  * Configure integrations.
  * Invite users or change settings.

  <Warning>
    Because the environment create endpoint (`PUT /api/v2/environments/{org}`) is idempotent — a re-PUT of an existing environment updates it — a snapshotter token can modify an existing environment's description, scaling, policies, and included environments by re-PUTting a full payload. Only the dedicated update paths (PATCH, archive, rename, policy attach/detach) are blocked. Keep this in mind when scoping snapshotter tokens for environments you don't want them to change.
  </Warning>

  ### When to assign

  Assign the Snapshotter role to:

  * Environment teams who need to manage runtime environments and report snapshots
  * Systems that only need to report environment state without modifying build pipelines

  ***
</Accordion>

<Accordion title="Reader" icon="eye">
  Readers have read-only access to view data in Kosli without the ability to create or modify resources.

  ### Permissions

  Readers can:

  * **View Data**: Access trails, artifacts, attestations, and snapshots
  * **Query Information**: Search and filter data across flows and environments
  * **Generate Reports**: Export and analyze compliance data
  * **View Configurations**: See flow definitions, policies, attestation types, and actions (but cannot modify them)

  Readers cannot:

  * Create, update, or delete any resources
  * Report attestations or snapshots
  * Create or manage actions
  * Create or manage service accounts
  * Configure integrations
  * Invite users or change settings

  ### When to assign

  Assign the Reader role to:

  * Auditors who need visibility into compliance data
  * Compliance officers reviewing attestation and deployment history
  * Stakeholders and executives who want to monitor software delivery
  * Reporting and monitoring systems that query Kosli data for dashboards
</Accordion>

## Assigning roles

To assign or change a user's role:

1. Log in to Kosli as an Admin
2. Navigate to your organization from the left navigation menu
3. Go to `Settings` > `Members`
4. Find the user you want to modify
5. Select their new role from the dropdown menu

<Note>
  Role changes take effect immediately. Users will see their updated permissions the next time they interact with Kosli.
</Note>

***

## Best practices

### Follow the principle of least privilege

Assign users the minimum role required to perform their job functions. Start with Reader access and increase permissions as needed.

### Use service accounts for automation

For CI/CD pipelines and automated systems, create service accounts with the Member role rather than using personal API keys. This provides better auditability and security.

### Regular access reviews

Periodically review user roles and remove access for team members who no longer need it. This is especially important when people change roles or leave the organization.

### Separate concerns

* **Admins**: Focus on governance, security, and organization-wide configuration
* **Members**: Handle day-to-day operations and resource management
* **Snapshotters**: Manage environments and policies without affecting build flows
* **Readers**: Provide visibility without risk of accidental changes

***

## See also

* [Mapping users to roles](/administration/managing_users/mapping_users_to_roles) — recommended Kosli roles for common organizational roles.
* [Service accounts](/administration/authentication/service_accounts) — assigning roles to machine users.


# Create or update environment action
Source: https://docs.kosli.com/api-reference/actions/create-or-update-environment-action

https://app.kosli.com/api/v2/openapi.json put /actions/{org}/environments
Create or Update an environment action for an org.



# Create or update flow action
Source: https://docs.kosli.com/api-reference/actions/create-or-update-flow-action

https://app.kosli.com/api/v2/openapi.json put /actions/{org}/flows
Create or Update a flow action for an org.



# Delete an action
Source: https://docs.kosli.com/api-reference/actions/delete-an-action

https://app.kosli.com/api/v2/openapi.json delete /actions/{org}/{action_number}
Delete a specific action for an org.



# Get action
Source: https://docs.kosli.com/api-reference/actions/get-action

https://app.kosli.com/api/v2/openapi.json get /actions/{org}/{action_number}
Get a specific action for an org.



# List actions
Source: https://docs.kosli.com/api-reference/actions/list-actions

https://app.kosli.com/api/v2/openapi.json get /actions/{org}
List actions for an org.



# Allow artifact for environment
Source: https://docs.kosli.com/api-reference/allowlists/allow-artifact-for-environment

https://app.kosli.com/api/v2/openapi.json put /allowlists/{org}/{env_name}
Allow an artifact for an environment.



# List allowlist
Source: https://docs.kosli.com/api-reference/allowlists/list-allowlist

https://app.kosli.com/api/v2/openapi.json get /allowlists/{org}
List Allowlist records in an organization.



# Get artifact audit package
Source: https://docs.kosli.com/api-reference/artifacts/get-artifact-audit-package

https://app.kosli.com/api/v2/openapi.json get /artifacts/{org}/{flow_name}/{fingerprint}/audit_package
Get audit package for an artifact.



# Get artifact by fingerprint
Source: https://docs.kosli.com/api-reference/artifacts/get-artifact-by-fingerprint

https://app.kosli.com/api/v2/openapi.json get /artifacts/{org}/{flow_name}/fingerprint/{fingerprint}
Get artifact by fingerprint.



# Get artifacts by commit SHA
Source: https://docs.kosli.com/api-reference/artifacts/get-artifacts-by-commit-sha

https://app.kosli.com/api/v2/openapi.json get /artifacts/{org}/{flow_name}/commit_sha/{commit_sha}
Get artifact by commit sha.



# Get latest artifact commit
Source: https://docs.kosli.com/api-reference/artifacts/get-latest-artifact-commit

https://app.kosli.com/api/v2/openapi.json get /artifacts/{org}/{flow_name}/{fingerprint}/latest_commit
Get the latest git commit of the artifact.



# List artifacts
Source: https://docs.kosli.com/api-reference/artifacts/list-artifacts

https://app.kosli.com/api/v2/openapi.json get /artifacts/{org}
List artifacts in organization. Can be filtered by flow name or repo name.

- The result is paginated.
- The list of artifacts is sorted by creation time in descending order.



# List artifacts in flow
Source: https://docs.kosli.com/api-reference/artifacts/list-artifacts-in-flow

https://app.kosli.com/api/v2/openapi.json get /artifacts/{org}/{flow_name}
Get artifacts in flow.



# Report artifact
Source: https://docs.kosli.com/api-reference/artifacts/report-artifact

https://app.kosli.com/api/v2/openapi.json post /artifacts/{org}/{flow_name}
Create an artifact for organization.



# Assert artifact
Source: https://docs.kosli.com/api-reference/asserts/assert-artifact

https://app.kosli.com/api/v2/openapi.json get /asserts/{org}/fingerprint/{fingerprint}
Assert an artifact.



# Attest custom
Source: https://docs.kosli.com/api-reference/attestation/attest-custom

https://app.kosli.com/api/v2/openapi.json post /attestations/{org}/{flow_name}/trail/{trail_name}/custom
Add custom attestation to a trail with an optional attachment file.



# Attest generic
Source: https://docs.kosli.com/api-reference/attestation/attest-generic

https://app.kosli.com/api/v2/openapi.json post /attestations/{org}/{flow_name}/trail/{trail_name}/generic
Add Generic attestation to a trail with an optional attachment file.



# Attest Jira issue
Source: https://docs.kosli.com/api-reference/attestation/attest-jira-issue

https://app.kosli.com/api/v2/openapi.json post /attestations/{org}/{flow_name}/trail/{trail_name}/jira
Add Jira attestation to a trail with an optional attachment file.



# Attest JUnit test results
Source: https://docs.kosli.com/api-reference/attestation/attest-junit-test-results

https://app.kosli.com/api/v2/openapi.json post /attestations/{org}/{flow_name}/trail/{trail_name}/junit
Add JUnit attestation to a trail with an optional attachment file.



# Attest pull request
Source: https://docs.kosli.com/api-reference/attestation/attest-pull-request

https://app.kosli.com/api/v2/openapi.json post /attestations/{org}/{flow_name}/trail/{trail_name}/pull_request
Add Pull-Request attestation to a trail with an optional attachment file.



# Attest Snyk scan
Source: https://docs.kosli.com/api-reference/attestation/attest-snyk-scan

https://app.kosli.com/api/v2/openapi.json post /attestations/{org}/{flow_name}/trail/{trail_name}/snyk
Add Snyk attestation to a trail with an optional attachment file.



# Attest Sonar scan
Source: https://docs.kosli.com/api-reference/attestation/attest-sonar-scan

https://app.kosli.com/api/v2/openapi.json post /attestations/{org}/{flow_name}/trail/{trail_name}/sonar
Add Sonar attestation to a trail with an optional attachment file.



# Attest system
Source: https://docs.kosli.com/api-reference/attestation/attest-system

https://app.kosli.com/api/v2/openapi.json post /attestations/{org}/{flow_name}/trail/{trail_name}/system
Add a system attestation to a trail.



# Get artifact attestation
Source: https://docs.kosli.com/api-reference/attestation/get-artifact-attestation

https://app.kosli.com/api/v2/openapi.json get /attestations/{org}/{flow_name}/artifact/{fingerprint}/{attestation_name}



# Get attestation evidence file
Source: https://docs.kosli.com/api-reference/attestation/get-attestation-evidence-file

https://app.kosli.com/api/v2/openapi.json get /attestations/{org}/{flow_name}/trail/{trail_name}/attestation/{attestation_id}/evidence
Download the evidence file attached to an attestation.



# Get trail attestation
Source: https://docs.kosli.com/api-reference/attestation/get-trail-attestation

https://app.kosli.com/api/v2/openapi.json get /attestations/{org}/{flow_name}/trail/{trail_name}/{attestation_name}



# List attestations
Source: https://docs.kosli.com/api-reference/attestation/list-attestations

https://app.kosli.com/api/v2/openapi.json get /attestations/{org}
Get a paginated list of attestations for an organization based on filters
provided as query parameters.



# List attestations for criteria
Source: https://docs.kosli.com/api-reference/attestation/list-attestations-for-criteria

https://app.kosli.com/api/v2/openapi.json get /attestations/{org}/list_attestations_for_criteria
List attestations matching a search criteria within an organization.

This endpoint returns a dictionary mapping commit SHAs to lists of attestations.
Each attestation contains metadata about compliance, timing, and type-specific data.

`commit_list` is required; it scopes the search to a specific set of commits.
`attestation_type`, `attestation_name`, and `flow_name` further narrow results
within that commit set but cannot be used on their own.

## Usage Examples

### Get all attestations for a list of commits
```
GET /attestations/my-org/list_attestations_for_criteria?commit_list=ae08fc6a5c963ae8dfaa0c27d8e5de9980d433b6
```

### Narrow by flow and attestation type
```
GET /attestations/my-org/list_attestations_for_criteria?commit_list=ae08fc6a5c963ae8dfaa0c27d8e5de9980d433b6&flow_name=production-flow&attestation_type=snyk
```

### Narrow by attestation name
```
GET /attestations/my-org/list_attestations_for_criteria?commit_list=ae08fc6a5c963ae8dfaa0c27d8e5de9980d433b6&attestation_name=manual-test
```

### Narrow by custom attestation type
```
GET /attestations/my-org/list_attestations_for_criteria?commit_list=ae08fc6a5c963ae8dfaa0c27d8e5de9980d433b6&attestation_type=custom:security-scan
```



# List flow attestations
Source: https://docs.kosli.com/api-reference/attestation/list-flow-attestations

https://app.kosli.com/api/v2/openapi.json get /attestations/{org}/{flow_name}
Get all attestations for a flow for a given time span.



# List system attestation types
Source: https://docs.kosli.com/api-reference/attestation/list-system-attestation-types

https://app.kosli.com/api/v2/openapi.json get /attestations/system-attestation-types
List all registered system attestation types with their per-version attestation_data schemas.



# Override attestation
Source: https://docs.kosli.com/api-reference/attestation/override-attestation

https://app.kosli.com/api/v2/openapi.json post /attestations/{org}/{flow_name}/trail/{trail_name}/override
Override an attestation in a trail.



# List membership/role change history for an org
Source: https://docs.kosli.com/api-reference/audit-log/list-membershiprole-change-history-for-an-org

https://app.kosli.com/api/v2/openapi.json get /membership-audit-log/{org}



# Build frequency statistics
Source: https://docs.kosli.com/api-reference/builds/build-frequency-statistics

https://app.kosli.com/api/v2/openapi.json get /builds/{org}/statistics
Build-frequency series for a repo within a time window.

Returns one timestamp per build (deduplicated by fingerprint) plus the
resolved window bounds and a count. Daily bucketing and the median are
computed client-side.

- end_ts defaults to now.
- start_ts defaults to 28 days before end_ts.



# List Builds
Source: https://docs.kosli.com/api-reference/builds/list-builds

https://app.kosli.com/api/v2/openapi.json get /builds/{org}
List builds for an organization.

- end_ts defaults to now.
- start_ts defaults to 28 days before end_ts.



# Archive a control
Source: https://docs.kosli.com/api-reference/controls/archive-a-control

https://app.kosli.com/api/v2/openapi.json post /controls/{org}/{identifier}/archive
**Beta** — the Controls feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# Create a control
Source: https://docs.kosli.com/api-reference/controls/create-a-control

https://app.kosli.com/api/v2/openapi.json post /controls/{org}
**Beta** — the Controls feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# Environment coverage for a control
Source: https://docs.kosli.com/api-reference/controls/environment-coverage-for-a-control

https://app.kosli.com/api/v2/openapi.json get /controls/{org}/{identifier}/coverage
**Beta** — the Controls feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# Get a control
Source: https://docs.kosli.com/api-reference/controls/get-a-control

https://app.kosli.com/api/v2/openapi.json get /controls/{org}/{identifier}
**Beta** — the Controls feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# Get a single decision for a control
Source: https://docs.kosli.com/api-reference/controls/get-a-single-decision-for-a-control

https://app.kosli.com/api/v2/openapi.json get /controls/{org}/{identifier}/decisions/{decision_id}
**Beta** — the Controls feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# Get a specific version of a control
Source: https://docs.kosli.com/api-reference/controls/get-a-specific-version-of-a-control

https://app.kosli.com/api/v2/openapi.json get /controls/{org}/{identifier}/versions/{version_number}
**Beta** — the Controls feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# List controls
Source: https://docs.kosli.com/api-reference/controls/list-controls

https://app.kosli.com/api/v2/openapi.json get /controls/{org}
**Beta** — the Controls feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# List decisions for a control
Source: https://docs.kosli.com/api-reference/controls/list-decisions-for-a-control

https://app.kosli.com/api/v2/openapi.json get /controls/{org}/{identifier}/decisions
**Beta** — the Controls feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# List distinct tag key/value pairs for an org's controls
Source: https://docs.kosli.com/api-reference/controls/list-distinct-tag-keyvalue-pairs-for-an-orgs-controls

https://app.kosli.com/api/v2/openapi.json get /controls/{org}/tags
**Beta** — the Controls feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# List versions of a control
Source: https://docs.kosli.com/api-reference/controls/list-versions-of-a-control

https://app.kosli.com/api/v2/openapi.json get /controls/{org}/{identifier}/versions
**Beta** — the Controls feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# Unarchive a control
Source: https://docs.kosli.com/api-reference/controls/unarchive-a-control

https://app.kosli.com/api/v2/openapi.json post /controls/{org}/{identifier}/unarchive
**Beta** — the Controls feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# Update a control
Source: https://docs.kosli.com/api-reference/controls/update-a-control

https://app.kosli.com/api/v2/openapi.json put /controls/{org}/{identifier}
**Beta** — the Controls feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# Archive custom attestation type
Source: https://docs.kosli.com/api-reference/custom-attestation-types/archive-custom-attestation-type

https://app.kosli.com/api/v2/openapi.json put /custom-attestation-types/{org}/{custom_attestation_type_name}/archive
Archive a custom attestation type.



# Create or update custom attestation type
Source: https://docs.kosli.com/api-reference/custom-attestation-types/create-or-update-custom-attestation-type

https://app.kosli.com/api/v2/openapi.json post /custom-attestation-types/{org}
Create or update a custom attestation type for an org.



# Get custom attestation type
Source: https://docs.kosli.com/api-reference/custom-attestation-types/get-custom-attestation-type

https://app.kosli.com/api/v2/openapi.json get /custom-attestation-types/{org}/{custom_attestation_type_name}
Get a custom attestation type.



# List custom attestation types
Source: https://docs.kosli.com/api-reference/custom-attestation-types/list-custom-attestation-types

https://app.kosli.com/api/v2/openapi.json get /custom-attestation-types/{org}
List all custom attestation types for an org.



# Get Deployment
Source: https://docs.kosli.com/api-reference/deployments/get-deployment

https://app.kosli.com/api/v2/openapi.json get /deployments/{org}/{env_name}/{fingerprint}
Get a single deployment by environment and fingerprint.



# List Deployments
Source: https://docs.kosli.com/api-reference/deployments/list-deployments

https://app.kosli.com/api/v2/openapi.json get /deployments/{org}
List deployments for an organization.

- end_ts defaults to now.
- start_ts defaults to 28 days before end_ts.



# Get environment diff
Source: https://docs.kosli.com/api-reference/envdiff/get-environment-diff

https://app.kosli.com/api/v2/openapi.json get /env-diff/{org}
Get diff between to snapshots



# Add environment to logical environment
Source: https://docs.kosli.com/api-reference/environments/add-environment-to-logical-environment

https://app.kosli.com/api/v2/openapi.json put /environments/{org}/{env_name}/join
Join the given physical environment to this Logical environment



# Archive environment
Source: https://docs.kosli.com/api-reference/environments/archive-environment

https://app.kosli.com/api/v2/openapi.json put /environments/{org}/{env_name}/archive
Archive an environment.



# Attach policy to environment
Source: https://docs.kosli.com/api-reference/environments/attach-policy-to-environment

https://app.kosli.com/api/v2/openapi.json post /environments/{org}/{env_name}/policies
Attach a Policy to an environment.



# Create or update environment
Source: https://docs.kosli.com/api-reference/environments/create-or-update-environment

https://app.kosli.com/api/v2/openapi.json put /environments/{org}
Create or update an Environment for an organization.



# Detach policy from environment
Source: https://docs.kosli.com/api-reference/environments/detach-policy-from-environment

https://app.kosli.com/api/v2/openapi.json delete /environments/{org}/{env_name}/policies
Detach a Policy from an environment.



# Get deployment frequency
Source: https://docs.kosli.com/api-reference/environments/get-deployment-frequency

https://app.kosli.com/api/v2/openapi.json get /environments/{org}/{env_name}/deployment_frequency
Get deployment frequency for a specific flow in an environment.



# Get environment
Source: https://docs.kosli.com/api-reference/environments/get-environment

https://app.kosli.com/api/v2/openapi.json get /environments/{org}/{env_name}
Get an environment for an organization.



# Get environment audit log
Source: https://docs.kosli.com/api-reference/environments/get-environment-audit-log

https://app.kosli.com/api/v2/openapi.json get /environments/{org}/{env_name}/auditlog
Get audit log (as a CSV file) for an environment.



# List deployments for an environment
Source: https://docs.kosli.com/api-reference/environments/list-deployments-for-an-environment

https://app.kosli.com/api/v2/openapi.json get /environments/{org}/{env_name}/deployments
List deployments for a single environment within a time range, newest first.



# List environment events
Source: https://docs.kosli.com/api-reference/environments/list-environment-events

https://app.kosli.com/api/v2/openapi.json get /environments/{org}/{env_name}/events
Get events log for an environment.

**Response Headers:**

* `X-Total-Count`: Total number of events available
* `X-Per-Page`: Number of events per page
* `X-Current-Page`: Current page number
* `X-Total-Pages`: Total number of pages
* `Link`: Pagination links (first, prev, next, last) when applicable

**Pagination Links Format:**
```
<url?page=1&per_page=15>; rel="first",
<url?page=2&per_page=15>; rel="prev",
<url?page=4&per_page=15>; rel="next",
<url?page=10&per_page=15>; rel="last"
```

**Note:** The Link header is only included when there are multiple pages.



# List environments
Source: https://docs.kosli.com/api-reference/environments/list-environments

https://app.kosli.com/api/v2/openapi.json get /environments/{org}
List environments of an organization.



# Rename environment
Source: https://docs.kosli.com/api-reference/environments/rename-environment

https://app.kosli.com/api/v2/openapi.json put /environments/{org}/{env_name}/rename
Rename an environment



# Report Azure Web and Function Apps environment
Source: https://docs.kosli.com/api-reference/environments/report-azure-web-and-function-apps-environment

https://app.kosli.com/api/v2/openapi.json put /environments/{org}/{env_name}/report/azure-apps
Process a report for an Azure Web and Function Apps environment.



# Report Cloud Run environment
Source: https://docs.kosli.com/api-reference/environments/report-cloud-run-environment

https://app.kosli.com/api/v2/openapi.json put /environments/{org}/{env_name}/report/cloud-run
Process a report for a Google Cloud Run environment.



# Report Docker environment
Source: https://docs.kosli.com/api-reference/environments/report-docker-environment

https://app.kosli.com/api/v2/openapi.json put /environments/{org}/{env_name}/report/docker
Process a report for a Docker environment.



# Report ECS environment
Source: https://docs.kosli.com/api-reference/environments/report-ecs-environment

https://app.kosli.com/api/v2/openapi.json put /environments/{org}/{env_name}/report/ECS
Process a report for an ECS environment.



# Report K8S environment
Source: https://docs.kosli.com/api-reference/environments/report-k8s-environment

https://app.kosli.com/api/v2/openapi.json put /environments/{org}/{env_name}/report/K8S
Process a report for a K8S environment.



# Report Lambda environment
Source: https://docs.kosli.com/api-reference/environments/report-lambda-environment

https://app.kosli.com/api/v2/openapi.json put /environments/{org}/{env_name}/report/lambda
Process a report for a Lambda environment.



# Report S3 environment
Source: https://docs.kosli.com/api-reference/environments/report-s3-environment

https://app.kosli.com/api/v2/openapi.json put /environments/{org}/{env_name}/report/S3
Process a report for an S3 environment.



# Report server environment
Source: https://docs.kosli.com/api-reference/environments/report-server-environment

https://app.kosli.com/api/v2/openapi.json put /environments/{org}/{env_name}/report/server
Process a report for a server environment.



# Update environment
Source: https://docs.kosli.com/api-reference/environments/update-environment

https://app.kosli.com/api/v2/openapi.json patch /environments/{org}/{env_name}
Update an existing Environment for an organization. Only fields present in the
request body are updated; omitted fields are left unchanged. Unlike the PUT
endpoint, an empty string for description will clear the description.



# Create an evaluation
Source: https://docs.kosli.com/api-reference/evaluations/create-an-evaluation

https://app.kosli.com/api/v2/openapi.json post /evaluations/{org}
**Beta** — the Server-side evaluation feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# Get an evaluation
Source: https://docs.kosli.com/api-reference/evaluations/get-an-evaluation

https://app.kosli.com/api/v2/openapi.json get /evaluations/{org}/{evaluation_id}
**Beta** — the Server-side evaluation feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# List evaluations
Source: https://docs.kosli.com/api-reference/evaluations/list-evaluations

https://app.kosli.com/api/v2/openapi.json get /evaluations/{org}
**Beta** — the Server-side evaluation feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# Archive flow
Source: https://docs.kosli.com/api-reference/flows/archive-flow

https://app.kosli.com/api/v2/openapi.json put /flows/{org}/{flow_name}/archive
Archive a flow.



# Create or update flow
Source: https://docs.kosli.com/api-reference/flows/create-or-update-flow

https://app.kosli.com/api/v2/openapi.json put /flows/{org}
Create or update a flow for an organization.



# Create or update flow with template
Source: https://docs.kosli.com/api-reference/flows/create-or-update-flow-with-template

https://app.kosli.com/api/v2/openapi.json put /flows/{org}/template_file
Create or update a flow for an organization.



# Get flow
Source: https://docs.kosli.com/api-reference/flows/get-flow

https://app.kosli.com/api/v2/openapi.json get /flows/{org}/{flow_name}
Get a flow for an organization.



# List flows
Source: https://docs.kosli.com/api-reference/flows/list-flows

https://app.kosli.com/api/v2/openapi.json get /flows/{org}
List flows for an organization.



# Rename flow
Source: https://docs.kosli.com/api-reference/flows/rename-flow

https://app.kosli.com/api/v2/openapi.json put /flows/{org}/{flow_name}/rename
Rename a flow.
The flow will remain available under its old name until that name is taken by another flow.



# Create or update environment notification
Source: https://docs.kosli.com/api-reference/organizations/create-or-update-environment-notification

https://app.kosli.com/api/v2/openapi.json put /organizations/{org}/environments_notifications
Create or Update an environments-notification for an org.



# Delete environment notification
Source: https://docs.kosli.com/api-reference/organizations/delete-environment-notification

https://app.kosli.com/api/v2/openapi.json delete /organizations/{org}/environments_notifications/{notification_number}
Delete a specific environments-notification for an org.



# Get environment notification
Source: https://docs.kosli.com/api-reference/organizations/get-environment-notification

https://app.kosli.com/api/v2/openapi.json get /organizations/{org}/environments_notifications/{notification_number}
Get a specific environments-notification for an org.



# Get organization
Source: https://docs.kosli.com/api-reference/organizations/get-organization

https://app.kosli.com/api/v2/openapi.json get /organizations/{org}
Get a specific org.



# List environment notifications
Source: https://docs.kosli.com/api-reference/organizations/list-environment-notifications

https://app.kosli.com/api/v2/openapi.json get /organizations/{org}/environments_notifications
List environments-notifications for an org.



# Update environment notification
Source: https://docs.kosli.com/api-reference/organizations/update-environment-notification

https://app.kosli.com/api/v2/openapi.json put /organizations/{org}/environments_notifications/{notification_number}
Update a specific environments-notification for an org.



# Create or update policy
Source: https://docs.kosli.com/api-reference/policies/create-or-update-policy

https://app.kosli.com/api/v2/openapi.json put /policies/{org}
Create or update a Policy in an organization.



# Get policy
Source: https://docs.kosli.com/api-reference/policies/get-policy

https://app.kosli.com/api/v2/openapi.json get /policies/{org}/{policy_name}
Get a Policy in an organization.



# List policies
Source: https://docs.kosli.com/api-reference/policies/list-policies

https://app.kosli.com/api/v2/openapi.json get /policies/{org}
List Policies in an organization.



# Deployment frequency and lead-time statistics for a repo
Source: https://docs.kosli.com/api-reference/repos/deployment-frequency-and-lead-time-statistics-for-a-repo

https://app.kosli.com/api/v2/openapi.json get /repos/{org}/{repo}/deployment-statistics
Per-environment deployment-frequency and lead-time series for a repo,
identified by its internal `id` (the `{repo}` path segment).

Returns one entry per non-logical environment the repo has been deployed to
(respecting the env filter), each with its raw `deployed_at` and
`lead_time_seconds` series plus the shared window bounds. Daily bucketing,
median and percentiles are computed client-side.

- end_ts defaults to now.
- start_ts defaults to 28 days before end_ts.



# Get a repo
Source: https://docs.kosli.com/api-reference/repos/get-a-repo

https://app.kosli.com/api/v2/openapi.json get /repos/{org}/{repo_name}
Get a repo by name, or unambiguously by its internal `id`.

Returns the repo's details, including its internal `id`, which is required to
tag the repo via the generic tags endpoint (PATCH /tags/{org}/repo/{id}).

If multiple repos share the same name across different VCS providers and
neither `id` nor `provider` is given, returns a 400 listing the providers to
choose from.



# Get live artifacts for a repo
Source: https://docs.kosli.com/api-reference/repos/get-live-artifacts-for-a-repo

https://app.kosli.com/api/v2/openapi.json get /repos/{org}/live-artifacts/{repo_name}
Get the live status of artifacts from a repository across all environments.

Returns a `RepoLiveStatusResponse` object that includes:
- `_embedded.environments`: environments that currently have running artifacts from this repo
- `_embedded.artifacts`: the corresponding artifacts for those environments
- `live_artifacts`: a flattened view of currently running artifacts, including each artifact's
  compliance status, fingerprint, commit SHA, and start timestamp.

Repo names are not unique within an org, so pass `id` to resolve an exact repo.
Otherwise, if multiple repos share the same name across different VCS providers, use the
`provider` parameter to disambiguate; without either, the most recently created match is used.



# List deployments for a repo
Source: https://docs.kosli.com/api-reference/repos/list-deployments-for-a-repo

https://app.kosli.com/api/v2/openapi.json get /repos/{org}/{repo}/deployments
List deployments for a repo, identified by its internal `id` (the `{repo}`
path segment), newest first.

- end_ts defaults to now.
- start_ts defaults to 28 days before end_ts.



# List repo filter options
Source: https://docs.kosli.com/api-reference/repos/list-repo-filter-options

https://app.kosli.com/api/v2/openapi.json get /repos/{org}/filter-options
List the distinct facet values (providers, VCS instances, and namespace
values) across the organization's repos, scoped by the given filters.

Used to populate the repos faceted filters. Each facet reflects every
filter except its own dimension, so alternative values stay visible (e.g.
the returned `providers` list isn't narrowed by the `provider` filter
itself). `namespace_values` cascades: it returns the values one level below
`namespace`, so drilling into a namespace reveals the next level.

Declared before the "/{org}/{repo_name}" route so the literal
"filter-options" segment is not captured as a repo name.



# List repo tag choices
Source: https://docs.kosli.com/api-reference/repos/list-repo-tag-choices

https://app.kosli.com/api/v2/openapi.json get /repos/{org}/tags
List the distinct tag key/value pairs across the organization's repos.

Used to populate the repos tag filter. Declared before the "/{org}/{repo_name}"
route so the literal "tags" segment is not captured as a repo name.



# List repos
Source: https://docs.kosli.com/api-reference/repos/list-repos

https://app.kosli.com/api/v2/openapi.json get /repos/{org}
List repos for an organization.

Repos are paginated.
- The response includes pagination information and the list of repos.
- The list of repos is sorted by the repo name; sort_direction selects the
  direction (asc = A–Z, the default; desc = Z–A).
- Optional filters: name (exact match), search (case-insensitive substring
  match on the name), provider (VCS provider), repo_id (external repo ID),
  vcs_instance (VCS host, exact match), namespace (namespace prefix), and
  tag (key or key:value, repeatable).
- name and search are mutually exclusive; providing both returns a 400.
- repo_id is the stronger identifier as names of repos can change. So if repo_id is provided, name is ignored.

Repos are captured when attestations include a reference to a repo.
This happens automatically when using Kosli CLI v2.11.35 or higher.



# Environment policy schema v1
Source: https://docs.kosli.com/api-reference/schemas/environment-policy-schema-v1

https://app.kosli.com/api/v2/openapi.json get /schemas/environment-policy/v1
Return the JSON Schema for the environment policy YAML format (v1).



# Flow template schema v1
Source: https://docs.kosli.com/api-reference/schemas/flow-template-schema-v1

https://app.kosli.com/api/v2/openapi.json get /schemas/flow-template/v1
Return the JSON Schema for the flow template YAML format (v1).



# Search artifacts by SHA or fingerprint
Source: https://docs.kosli.com/api-reference/search/search-artifacts-by-sha-or-fingerprint

https://app.kosli.com/api/v2/openapi.json get /search/{org}/sha/{search_value}
Get artifacts that match fingerprint or commit-sha.



# Create a service account
Source: https://docs.kosli.com/api-reference/service-accounts/create-a-service-account

https://app.kosli.com/api/v2/openapi.json post /service-accounts/{org}
Create a new service account in the organization. API keys are minted
separately via the `/{name}/api-keys` endpoint.



# Create an API key for a service account
Source: https://docs.kosli.com/api-reference/service-accounts/create-an-api-key-for-a-service-account

https://app.kosli.com/api/v2/openapi.json post /service-accounts/{org}/{name}/api-keys
Create a new API key for a service account. The key value is only returned once.



# Delete a service account
Source: https://docs.kosli.com/api-reference/service-accounts/delete-a-service-account

https://app.kosli.com/api/v2/openapi.json delete /service-accounts/{org}/{name}
Remove a service account from the organization.



# Get a service account
Source: https://docs.kosli.com/api-reference/service-accounts/get-a-service-account

https://app.kosli.com/api/v2/openapi.json get /service-accounts/{org}/{name}
Get a single service account by name.



# Get an API key for a service account
Source: https://docs.kosli.com/api-reference/service-accounts/get-an-api-key-for-a-service-account

https://app.kosli.com/api/v2/openapi.json get /service-accounts/{org}/{name}/api-keys/{key_id}
Get a single active API key for a service account.



# List API keys for a service account
Source: https://docs.kosli.com/api-reference/service-accounts/list-api-keys-for-a-service-account

https://app.kosli.com/api/v2/openapi.json get /service-accounts/{org}/{name}/api-keys
List all active API keys for a service account.



# List service accounts in an organization
Source: https://docs.kosli.com/api-reference/service-accounts/list-service-accounts-in-an-organization

https://app.kosli.com/api/v2/openapi.json get /service-accounts/{org}
List all service accounts in the organization.



# Revoke an API key for a service account
Source: https://docs.kosli.com/api-reference/service-accounts/revoke-an-api-key-for-a-service-account

https://app.kosli.com/api/v2/openapi.json delete /service-accounts/{org}/{name}/api-keys/{key_id}
Revoke an API key for a service account.



# Rotate an API key for a service account
Source: https://docs.kosli.com/api-reference/service-accounts/rotate-an-api-key-for-a-service-account

https://app.kosli.com/api/v2/openapi.json post /service-accounts/{org}/{name}/api-keys/{key_id}/rotate
Rotate an API key for a service account. A new key is generated immediately.
The old key remains valid for `grace_period_hours` (default 24) to allow
time to update dependent systems. The new key value is only returned once.



# Update a service account
Source: https://docs.kosli.com/api-reference/service-accounts/update-a-service-account

https://app.kosli.com/api/v2/openapi.json patch /service-accounts/{org}/{name}
Update a service account's description and/or privilege. Sending
`description: null` clears the description; omitting the field leaves
it unchanged.



# Get snapshot
Source: https://docs.kosli.com/api-reference/snapshots/get-snapshot

https://app.kosli.com/api/v2/openapi.json get /snapshots/{org}/{env_name}/{snapshot_expression}
Get a snapshot for an environment.

`snapshot_expression` can be specified as follows:
- `N`: the Nth snapshot, counting from 1. Negative values count from the latest snapshot i.e. -1 is the latest snapshot.
    example: 42
- `~N`: the Nth snapshot behind the latest, at the time of the request
    example: ~5
- `@{YYYY-MM-DDTHH:MM:SS}`: the snapshot at specific moment in time in UTC
    example: @{2023-10-02T12:00:00}
- `@{N.<hours|days|weeks|months>.ago}`: the snapshot at a time relative to the time of the request. N is a positive integer.
    example: @{2.hours.ago}
- `@{now}`: the snapshot at the time of the request
    example: @{now}



# List snapshots
Source: https://docs.kosli.com/api-reference/snapshots/list-snapshots

https://app.kosli.com/api/v2/openapi.json get /snapshots/{org}/{env_name}
Get list of snapshots for an environment.



# Update tags
Source: https://docs.kosli.com/api-reference/tags/update-tags

https://app.kosli.com/api/v2/openapi.json patch /tags/{org}/{resource_type}/{resource_id}
Patch tags for resource.



# Begin trail
Source: https://docs.kosli.com/api-reference/trails/begin-trail

https://app.kosli.com/api/v2/openapi.json put /trails/{org}/{flow_name}
Add a Trail to a Flow.



# Download trail audit package
Source: https://docs.kosli.com/api-reference/trails/download-trail-audit-package

https://app.kosli.com/api/v2/openapi.json get /trails/{org}/{flow_name}/{trail_name}/audit_package
Download the full trail audit package (same content as the app “Download Full Audit Package”).



# Download trail audit PDF
Source: https://docs.kosli.com/api-reference/trails/download-trail-audit-pdf

https://app.kosli.com/api/v2/openapi.json get /trails/{org}/{flow_name}/{trail_name}/audit_pdf
Download only the trail PDF report (same as `trail-page.pdf` inside the full audit package).



# Get trail
Source: https://docs.kosli.com/api-reference/trails/get-trail

https://app.kosli.com/api/v2/openapi.json get /trails/{org}/{flow_name}/{trail_name}
Get a Trail for a Flow in an organization.



# Get trail moment
Source: https://docs.kosli.com/api-reference/trails/get-trail-moment

https://app.kosli.com/api/v2/openapi.json get /trails/{org}/{flow_name}/{trail_name}/moments/{moment_expression}
**Beta** — the Server-side evaluation feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# List trail moments
Source: https://docs.kosli.com/api-reference/trails/list-trail-moments

https://app.kosli.com/api/v2/openapi.json get /trails/{org}/{flow_name}/{trail_name}/moments
**Beta** — the Server-side evaluation feature is in beta. Requests from organizations without it enabled receive `403 Forbidden`.



# List trails
Source: https://docs.kosli.com/api-reference/trails/list-trails

https://app.kosli.com/api/v2/openapi.json get /trails/{org}/{flow_name}
List Trails of a Flow.



# List trails for organization
Source: https://docs.kosli.com/api-reference/trails/list-trails-for-organization

https://app.kosli.com/api/v2/openapi.json get /trails/{org}
Get a paginated list of trails for an organization based on filters provided as query parameters.



# Get default organization
Source: https://docs.kosli.com/api-reference/user/get-default-organization

https://app.kosli.com/api/v2/openapi.json get /user/default-org
Get the default org for the current user.



# Set default organization
Source: https://docs.kosli.com/api-reference/user/set-default-organization

https://app.kosli.com/api/v2/openapi.json put /user/{org}
Set a default org for the current user.



# Changelog
Source: https://docs.kosli.com/changelog/index

Release notes for Kosli products.

<Update label="September 1, 2026" description="v2.39.2">
  ## Updates

  * **Help text fixes** — corrected typos in the help text for [`kosli attest sonar`](/client_reference/kosli_attest_sonar) and its `--sonar-working-dir` flag description.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.39.2)
</Update>

<Update label="August 31, 2026" description="">
  ## Bug fixes

  * **Attestations filter no longer breaks infinite scroll** — applying a filter on the org attestations list while a page request was still in flight could stop pagination for the rest of the session: the first page of filtered results rendered and nothing more, with no error. Filter and page requests are now serialized.
</Update>

<Update label="August 30, 2026" description="v2.39.1">
  ## Updates

  * **Clearer help text** — reworded the help for [`kosli attest jira`](/client_reference/kosli_attest_jira), [`kosli attest sonar`](/client_reference/kosli_attest_sonar), and [`kosli snapshot azure`](/client_reference/kosli_snapshot_azure), and fixed formatting glitches in the generated CLI reference.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.39.1)
</Update>

<Update label="August 29, 2026" description="v2.39.0">
  ## New features

  * **`--sonar-branch` on `kosli attest sonar`** — attest a SonarQube scan that ran on a branch other than the project's main branch by naming the branch. The flag cannot be combined with `--pull-request`. When a scan revision is not found, the error now says that only the main branch was searched and suggests passing `--sonar-branch`. See the [`kosli attest sonar` reference](/client_reference/kosli_attest_sonar).

  ## Updates

  * **`kosli attest jira` reports rejected credentials as such** — when Jira does not accept the credentials (for example an expired API token), the CLI prints a warning naming the username and reports the affected issues as "not confirmed" instead of silently as missing. The `--assert` failure message distinguishes missing, unconfirmed, and mixed cases. See the [`kosli attest jira` reference](/client_reference/kosli_attest_jira).
  * **`--jira-project-key` tolerates whitespace** — comma-separated lists like `"ABC, DEF"` are now accepted; each key is trimmed before validation, and invalid keys are quoted in the error message.
  * **`.kosli_ignore` documented in command help** — the help for `kosli allow artifact`, `kosli assert artifact`, and every `kosli attest` command now describes `.kosli_ignore` support when fingerprinting directories.

  ## Bug fixes

  * **`kosli version` reports the real release inside published Docker images** — published images identified themselves as `dev+<commit-sha>` instead of the release tag they were built from, so `kosli version` in a container could not tell you which release was running. Any image published before v2.39.0 is affected; images from v2.39.0 onward report their release tag.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.39.0)
</Update>

<Update label="August 28, 2026" description="">
  ## New features

  * **Spaces enabled for every org** — Spaces, the hierarchical tree for organizing flows and environments, is now available to every organization by default. The Manage Spaces page and the Space filter on the Flows and Environments lists no longer require a feature flag or an org-level opt-in setting, both of which are gone. See [organizing flows and environments with Spaces](/tutorials/organizing_with_spaces).
</Update>

<Update label="August 27, 2026" description="">
  ## Bug fixes

  * **Policy expressions treat a missing value as never matching** — `matches()` and the ordering comparisons (`<`, `>`, `<=`, `>=`) now evaluate to `false` when either side is missing, consistent with how `==`, `!=`, `in`, and `exists()` already behaved. Missing values are common: `flow` is empty for any artifact without provenance, and `flow.tags.<key>` is empty for a tag a flow doesn't have. Previously an expression like `not matches(flow.name, "^snyk-.*")` crashed snapshot compliance evaluation, and could return a 500 from the assert-artifact endpoint. See [policy expressions](/policy-reference/environment_policy#policy-expressions).
</Update>

<Update label="August 26, 2026" description="">
  ## Updates

  * **Environments tag filter drills into values** — the tag filter on the Environments list now offers both key-existence and key:value filtering, matching the Flows, Repos, and Controls pages. Previously it only listed keys, which made it useless when environments share keys but differ on values.

  ## Bug fixes

  * **Environment policies see override attestations** — `attestation` rules in [environment policies](/policy-reference/environment_policy) (and the assert-artifact API) now evaluate the newest attestation including overrides. Previously an override never matched the rule's attestation type, so overriding a non-compliant attestation could not bring an environment back to compliant, and overriding a compliant one down to non-compliant left the environment falsely reporting compliant.
  * **Archived resources disappear from the Spaces tree** — archiving two or more environments or flows could leave some of them still showing on the Spaces page. All archived resources are now filtered out.
  * **Attestation reads tolerate retargeted artifact names** — reading attestations no longer fails with a 500 when the same fingerprint was later reported under a different artifact name in the same trail. The artifact-name consistency check now runs when an attestation is written, not on every read.
</Update>

<Update label="August 24, 2026" description="">
  ## Updates

  * **Cleaner timestamps on the flows list** — the flows list now shows a plain date and time, matching the environments list, instead of a stacked icon, caption, and timestamp. The frequency-chart tooltip on the repo page also switches from DD/MM/YYYY to the app-standard YYYY-MM-DD.
</Update>

<Update label="August 20, 2026" description="">
  ## Bug fixes

  * **Empty attestation names refused in flow templates** — a flow template with an attestation named `""` could be saved but never satisfied, since no attestation can be reported under that name. Creating or updating a template with an empty attestation name is now rejected with a clear error. Existing records with the empty value still load.
  * **Empty filenames refused when reporting artifacts** — `POST` to the artifact create endpoint with `filename: ""` is now rejected instead of storing a blank filename against the artifact's fingerprint.
  * **A single malformed record no longer breaks list endpoints** — on environments, flows, artifacts, and other list endpoints, an exception rendering one record used to fail the whole response for every caller. The listing now returns successfully with a clearly-marked placeholder in place of the bad record.
</Update>

<Update label="August 19, 2026" description="v2.38.0">
  ## New features

  * **Custom attestation type summaries** — `kosli create attestation-type` now accepts `--summary`, a repeatable `'NAME=EXPRESSION'` entry (for example `--summary "Critical=.critical_count"`), and `--summary-json`, the same list given as a JSON array of `{name, expression}` entries. Each expression is a jq expression evaluated against the attestation payload, and Kosli renders the results as labeled rows on the attestation detail page, in the order given. The two flags cannot be combined. See [custom attestation types](/getting_started/attestations) and the [`kosli create attestation-type` reference](/client_reference/kosli_create_attestation-type).

  ## Bug fixes

  * **`kosli begin trail` no longer wipes description and user\_data on re-run** — running `kosli begin trail` without `--description` or `--user-data` used to send empty values and overwrite whatever was stored. The CLI now omits those fields when they aren't set, matching how the API behaves.
  * **Docker image has a writable `/tmp`** — the scratch-based image now ships an empty `/tmp`, so operations that rely on a temp directory (directory fingerprinting, evidence tarballing) work inside the container.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.38.0)
</Update>

<Update label="August 19, 2026" description="">
  ## Updates

  * **Scaling removed from environments** — capture of scale-only changes has been retired. An instance-count-only difference no longer creates a new snapshot or annotates an artifact as scaled, and the `include_scaling` environment setting is gone. Instance counts are still recorded on snapshots saved for another reason. Scaling had no compliance value: when a workload scales up or down, the artifact, its digest, and its provenance are unchanged.
</Update>

<Update label="August 18, 2026" description="">
  ## Bug fixes

  * **`attest override --commit` no longer 500s without prior git provenance** — overriding an attestation that was reported without a commit failed with a 500 when the override supplied `--commit`. Overrides now work whether or not the original attestation had git provenance.
  * **Environment listing tolerates logical environments without included environments** — a logical environment created with no `--included-environments` could 500 the org's whole environment listing. The listing now returns normally, and newly created logical environments always record an explicit (possibly empty) included-environments list.
</Update>

<Update label="August 18, 2026" description="v2.37.0">
  ## Breaking changes

  * **An empty flag value is refused** — `--flag ""` is now an error on every flag of every command, wherever the value comes from: the command line, a `KOSLI_` environment variable, or `~/.kosli.yml`. Accepting it was a bug. An empty value never did what the command was asked to do, and usually reported success anyway, so a pipeline that starts failing here was already producing a result nobody asked for. The usual cause is a shell variable that is unset. The error names the flag: give it a real value, or remove the flag, since in almost every case an empty value did what leaving the flag out does. Leaving a flag out is unchanged, including defaults filled in from your CI environment. See [empty flag values](/faq/faq#empty-flag-values).
  * **`--description ""` no longer clears a description** — on `kosli update control` and `kosli update service-account`, an empty value was the only way to empty a description. That is no longer possible: a description can be changed but not emptied.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.37.0)
</Update>

<Update label="August 18, 2026" description="v0.9.3">
  ## New features

  * **`summary` attribute on `kosli_custom_attestation_type`** — the resource and data source now accept an optional `summary`: a JSON list of ordered, labeled jq expressions that Kosli renders as rows on the attestation detail page. URL values render as links.

    ```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    resource "kosli_custom_attestation_type" "security_scan" {
      name     = "security-scan"
      schema   = file("${path.module}/schemas/security-scan.json")
      jq_rules = [".critical_count == 0"]

      summary = jsonencode([
        { name = "Critical", expression = ".critical_count" },
        { name = "Report",   expression = ".report_url" },
      ])
    }
    ```

    See [custom attestation types](/getting_started/attestations).

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.9.3)
</Update>

<Update label="August 17, 2026" description="">
  ## Updates

  * **Faster snapshot responses** — `GET /api/v2/snapshots*` used to fetch each artifact's provenance one at a time and read every attestation on the artifact. Provenance lookups are now batched across a snapshot's artifacts, and only the newest attestation is read per artifact. On snapshots with a single running artifact this cuts multi-second waits down to well under a second.

  ## Bug fixes

  * **Flows list no longer breaks on legacy `repo_url` values** — flows created before the artifact endpoint moved to strict URL validation could store a non-URL `repo_url`, which caused the flows page to return an error instead of the list. Invalid values are now repaired (scp-style Azure remotes converted to browse URLs, scheme-less hosts prefixed with `https://`, known placeholders removed) so the page loads.
</Update>

<Update label="August 14, 2026" description="v2.36.6">
  ## Bug fixes

  * **Empty multi-value flag elements rejected** — `--attachments` or `--template` values that expand to an empty element (for example from an unset shell variable) now fail with a clear error naming the flag instead of being silently dropped.
  * **Empty boolean flag values rejected** — passing an empty value to a boolean flag (for example `--compliant ""` or `--new-compliance-status ""`) now fails with a clear error instead of recording the opposite compliance verdict.
  * **`KOSLI_*` env vars set to empty treated as unset** — `KOSLI_CONFIG_FILE=""` no longer suppresses config file loading, and `KOSLI_API_TOKEN=""` no longer skips decryption of a config-file token. Both fall back to the default.
  * **Bad config values surface errors** — config file or environment values that cannot be applied to a flag now produce an error naming the flag and its source, instead of silently failing.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.36.6)
</Update>

<Update label="August 14, 2026" description="">
  ## New features

  * **Custom attestation summaries** — [custom attestation types](/getting_started/attestations) can now define a `summary` list of JQ expressions that extract key values (for example `Critical`, `Tool`) from the payload. The attestation drawer renders these as labeled rows instead of only raw JSON, matching the built-in Sonar, Snyk, and JUnit types. Summaries are versioned with the type, so schema changes create a new version. Array payloads render one summary group per element.
</Update>

<Update label="August 13, 2026" description="">
  ## Updates

  * **Flows list rebuilt as a React page** — `/<org>/flows/` now runs as a React island. Search, space filter, sort (by name or latest activity), and paging update in place instead of triggering a full page reload. The `GET /api/v2/flows/{org}` endpoint gained `latest_activity_at` and `latest_state` fields and a `sort` (`name` | `latest_activity`) parameter with `sort_direction` to power the new UI.
</Update>

<Update label="August 11, 2026" description="">
  ## Bug fixes

  * **Faster webhook saves** — the SSRF guard on webhook URLs no longer performs a blocking DNS lookup while saving an action. A slow resolver can no longer stall the save (or time out the request).
  * **Notification emails and trail events hardened against injected HTML** — user-controlled names and descriptions in notification emails and trail event descriptions are now HTML-escaped when rendered, closing a defense-in-depth gap on top of existing input validation.
</Update>

<Update label="August 7, 2026" description="">
  ## Bug fixes

  * **React pages redirect to login on session timeout** — Controls, Repos, Environments, and Audit Log now send you to the login page (with `next` set to where you were) when the session expires, instead of leaving the page with a generic error.
  * **Unmatched `/api/*` returns JSON 404** — a request to a non-existent `/api/*` path now returns a JSON `404` instead of redirecting to the HTML login page, so API clients see a proper error.
</Update>

<Update label="August 5, 2026" description="">
  ## Bug fixes

  * **Login email field focused on load** — the email input on the login and sign-in pages now receives focus automatically, so you can start typing straight away.
  * **No more double-login inside off-canvas panels** — when a session expired while an off-canvas panel was open, the login page could get swapped into the panel instead of taking over the tab. Auth redirects from htmx requests now navigate the whole tab.
</Update>

<Update label="August 4, 2026" description="">
  ## Updates

  * **Readable summary for override attestations** — an override attestation now opens on a summary showing the reason, the original attestation's type and status, and a link to the attestation it overrides. The raw JSON payload is still available in the raw view.

  ## Bug fixes

  * **Trail-by-artifact lookups no longer fail with tag filters** — `GET /api/v2/trails/{org}` filtered by fingerprint and `flow_tag` could return a 500 on large orgs because the database ran out of memory ordering the query. The fingerprint is now matched before flow filters, so these lookups return normally.
</Update>

<Update label="August 3, 2026" description="v2.36.4">
  ## Bug fixes

  * **`kosli attest` no longer fails on container-produced attachments** — passing two or more `--attachments` paths could abort with `chown ...: operation not permitted` when an attachment (for example lint, test, or coverage output) had been written by a Docker container running as a different user. The CLI no longer tries to preserve file ownership when staging attachments for upload. A genuine copy error now also names the evidence path you passed rather than an internal temp directory. See the [`kosli attest artifact` reference](/client_reference/kosli_attest_artifact) for usage.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.36.4)
</Update>

<Update label="July 31, 2026" description="v2.36.3">
  ## Updates

  * **Deprecated flags visible in reference docs** — deprecated flags (for example `--registry-provider`) are now listed in the [CLI reference](/client_reference) with their migration message, instead of being silently hidden.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.36.3)
</Update>

<Update label="July 31, 2026" description="">
  ## Updates

  * **Cleaner snapshot change summaries** — an artifact is no longer marked as `changed` when only its timestamp differs from the previous snapshot (for example a touched file or a restarted pod). Only differences that carry compliance meaning now produce a change event, so real changes stand out on the snapshot page.
  * **Snapshot event counts add up** — the started/changed/exited breakdown next to a snapshot's total event count now includes legacy `changed` events, so the totals match.
  * **Accurate compliance evaluation timestamps** — `compliance_status.evaluated_at` on the v2 API now reflects the event that triggered the evaluation, instead of the previous one. Verdicts no longer appear to predate the attestation inside them.

  ## Bug fixes

  * **Instance count hidden without scaling capture** — environments that don't capture scaling no longer display a stale instance count on artifact and event views.
</Update>

<Update label="July 30, 2026" description="v2.36.2">
  ## New features

  * **Non-interactive delete safety** — `kosli delete api-key` and `kosli delete service-account` now fail with a clear error when stdin is not a TTY (for example in CI) instead of silently exiting without deleting. Pass `--assume-yes` to delete non-interactively.

  ## Updates

  * **`--include-scaling` / `--exclude-scaling` deprecated** — these flags on `kosli create environment` and `kosli snapshot` now print a deprecation warning. Scaling events no longer trigger new snapshots.

  ## Bug fixes

  * **Payload logging failures no longer abort requests** — a failure to log an outgoing request payload now warns instead of exiting, so the request itself is no longer canceled.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.36.2)
</Update>

<Update label="July 30, 2026" description="v0.9.2">
  ## Breaking changes

  * **`include_scaling` removed from `kosli_environment`** — the `include_scaling` attribute has been removed from both the `kosli_environment` resource and data source. The Kosli API no longer honors it (it always reports `false`), and setting it to `true` caused apply failures. Remove any `include_scaling` values from your configuration before upgrading.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.9.2)
</Update>

<Update label="July 29, 2026" description="v2.36.1">
  ## Bug fixes

  * **FAQ URL typo** — fixed a double slash in the FAQ link shown when boolean flag arguments are misused (`https://docs.kosli.com//faq/` → `https://docs.kosli.com/faq/`).

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.36.1)
</Update>

<Update label="July 28, 2026" description="v2.36.0">
  ## Updates

  * **Cleaner errors for unknown commands** — unrecognized command tokens (for example `kosli list garbage`) now report an error and exit non-zero instead of silently exiting `0`.
  * **Boolean flag help cleanup** — the boolean-flag FAQ link has been removed from the `--compliant` and `--compliance-status` flag descriptions now that space-form booleans are handled correctly.

  ## Bug fixes

  * **Space-form boolean flags** — boolean flags written in the space form (for example `--compliant false`) were being misread as positional arguments, causing spurious errors or silently wrong behavior. They now parse correctly.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.36.0)
</Update>

<Update label="July 28, 2026" description="v2.35.0">
  ## Breaking changes

  * **Approval commands removed** — `kosli assert approval`, `kosli get approval`, `kosli list approvals`, `kosli report approval`, and `kosli request approval` are gone, along with the `kosli request` parent command, since `request approval` was its only subcommand. They were deprecated in v2.20.0. Use [attestations](/getting_started/attestations) to record approval evidence instead.

  ## Updates

  * **k8s-reporter Helm chart (2.6.0)** — the `--auto-environment` flag and its companions (`--environment-description`, `--include-scaling`, `--exclude-scaling`) are now exposed as `reporterConfig.*` values, so the reporter CronJob can auto-create a K8S environment on first run without editing the chart.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.35.0)
</Update>

<Update label="July 28, 2026" description="">
  ## Breaking changes

  * **Approval API removed** — the deprecated approval endpoints under `/api/v2/approvals/` no longer exist. Approvals are also gone from custom webhook notification payloads and from artifact responses. Use [attestations](/getting_started/attestations) to record approval evidence instead.
</Update>

<Update label="July 26, 2026" description="v2.34.0">
  ## New features

  * **Auto-create environments from `kosli snapshot`** — new `--auto-environment` flag (alias `--auto-env`, shorthand `-A`) on all `kosli snapshot` subcommands creates the target environment (with the type inferred from the subcommand) if it doesn't already exist. Pair with `--environment-description` to set a description, and `--include-scaling` / `--exclude-scaling` (mutually exclusive) to control scaling-event behaviour on auto-created environments.

  ## Updates

  * **More informative error messages** — command errors now include the command path, and the `--flow` / `--trail` values when set, making it easier to spot which invocation failed when running multiple similar commands in a script.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.34.0)
</Update>

<Update label="July 23, 2026" description="v2.33.3">
  ## Bug fixes

  * **PR evidence for deleted GitHub accounts** — PR evidence reports now always include the `author` field (as an empty string when unknown), so pull requests whose creator's GitHub account has been deleted no longer fail server-side validation.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.33.3)
</Update>

<Update label="July 21, 2026" description="v2.33.2">
  ## Updates

  * **Bitbucket API tokens in help text** — Bitbucket Cloud is removing app password authentication on 28 July 2026. CLI help and generated command reference now point to Atlassian API tokens instead: pass your Atlassian account email to `--bitbucket-username` and the API token to `--bitbucket-password`. `--bitbucket-access-token` is unaffected.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.33.2)
</Update>

<Update label="July 15, 2026" description="">
  ## New features

  * **Per-domain MagicLink login** — MagicLink login can now be enabled for individual customer email domains on shared multi-tenant instances, instead of only per-deployment.
</Update>

<Update label="July 14, 2026" description="">
  ## Bug fixes

  * **MagicLink double email** — fixed a form-submission race where password-manager extensions could trigger two MagicLink emails for a single login attempt.
  * **Concurrent create races** — concurrent duplicate creates on flows and other unique-indexed resources now return a retryable `409` instead of surfacing as a `500`.
</Update>

<Update label="July 14, 2026" description="v2.33.1">
  ## Bug fixes

  * **`--repository` no longer overrides CI-detected repo names** — the flag's default value could overwrite a fuller CI-detected repository name (for example GitLab's `CI_PROJECT_PATH`) in the reported repo info. It now only overrides the CI-detected name when set explicitly.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.33.1)
</Update>

<Update label="July 10, 2026" description="v0.8.1">
  ## New features

  * **`kosli_control` list resource** — the provider now ships a list resource for `kosli_control`, so you can discover existing (unmanaged) controls with `terraform query` and generate import and configuration blocks for them. Supports the API's `search` and `archived` filters. Requires Terraform 1.14+ (the managed resource still works on Terraform 1.10+).

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.8.1)
</Update>

<Update label="July 10, 2026" description="v2.33.0">
  ## New features

  * **`kosli list repos` filtering and sorting** — new `--search` flag filters repos by case-insensitive name substring (mutually exclusive with `--name`), `--tag` filters by tag key or `key:value`, and `--sort-direction` sorts results ascending or descending by name.
  * **`kosli list controls` sorting** — new `--sort-direction` flag sorts results ascending or descending by name.

  ## Updates

  * **Clearer registry credential help** — `--registry-username` and `--registry-password` descriptions and root help now document that these are only needed when credentials aren't already available via Docker/Podman auth files or a credential helper, and spell out the automatic credential resolution order for `--artifact-type=oci` and `--artifact-type=docker`.
  * **`kosli list environments --tag`** — the `--tag` flag now accepts repeated values consistently with other list commands.
  * **Clarified `--tag` help for controls** — the flag description now states that repeating it matches more than one tag.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.33.0)
</Update>

<Update label="July 10, 2026" description="">
  ## Updates

  * **Refreshed repo pages** — repo pages now share a single header (name, provider badge, VCS id, repo URL) above the Build, Release, and Run tabs, and switching between tabs happens client-side without a full page reload. Deep links and Release sub-tabs continue to work.
  * **Repo tag management from the header** — manage repo tags directly from the new repo header via the kebab menu.
</Update>

<Update label="July 9, 2026" description="v2.32.1">
  ## Updates

  * `kosli list repos` table output now shows a pagination footer (`Showing page 1 of N, total N repos`) and includes expanded help and usage examples.
  * `kosli list repos` `--name` flag description now clarifies that it performs an exact match.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.32.1)
</Update>

<Update label="July 8, 2026" description="v2.32.0">
  ## New features

  * **Repo commands are GA** — `kosli get repo` and `kosli list repos` are no longer hidden and are now generally available.
  * **Fetch a repo by internal ID** — `kosli get repo` now supports `--repo-id` (mutually exclusive with the `REPO-NAME` argument).
  * **Repo tagging** — `kosli tag` now supports tagging repos (`repo`/`repos` resource types), with disambiguation via `--provider` or `--repo-id`. `--set` and `--unset` gain short aliases `-s` and `-u`.

  ## Updates

  * `kosli get repo` and `kosli list repos` table output now include a `Tags` column showing key=value pairs.
  * `kosli get repo` now returns an error (instead of a "not found" message) when a repo does not exist or when multiple repos match the given name, and suggests using `--provider` to disambiguate.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.32.0)
</Update>

<Update label="July 8, 2026" description="v0.8.0">
  ## New features

  * **`kosli_control` resource and data source (beta)** — manage Kosli controls as Terraform resources. The resource supports `identifier` (immutable), `name`, `description`, and `links`, plus computed `version`, `created_at`, `created_by`, `tags`, and `policies_referencing`, and can be imported by `identifier`. Archived controls are treated as deleted for drift detection.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.8.0)
</Update>

<Update label="July 8, 2026" description="">
  ## New features

  * **Repo tags** — repos can now be tagged, and tags appear in repo listings.

  ## Updates

  * **Faster customer usage metrics** — internal usage metrics are computed with chunked org counts, avoiding timeouts on large tenants.
  * **Cleaner environment deployments table** — artifact names are simplified and column widths are adjusted for readability.
</Update>

<Update label="July 7, 2026" description="v0.7.0">
  ## New features

  * **Service account resources** — new `kosli_service_account` and `kosli_service_account_api_key` resources let you manage service accounts and their API keys in Terraform. Service accounts support `name`, `description`, and `privilege` with import by `name`. API keys are minted as write-once sensitive values; all arguments force replacement since keys are immutable.
  * **`kosli_service_account` data source** — look up existing service accounts by `name`.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.7.0)
</Update>

<Update label="July 7, 2026" description="">
  ## New features

  * **Environment deployments report** — new deployments report for environments, gated behind a feature flag during rollout.

  ## Updates

  * **Space resources link to their pages** — flow and environment names in space views now link directly to their flow/environment pages.

  ## Bug fixes

  * **Duplicate environment create** — fixed an unhandled error when two clients concurrently created the same environment.
</Update>

<Update label="July 6, 2026" description="v2.31.0">
  ## New features

  * **`kosli get api-key`** — new command (alias: `ak`) to retrieve metadata for a specific API key belonging to a service account. Supports `--output table` (default) and `--output json`.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.31.0)
</Update>

<Update label="July 6, 2026" description="">
  ## Updates

  * **Faster logical environment pages** — logical environment page loads are noticeably quicker.
  * **More reliable org deletion** — org deletion now waits longer for HubSpot opt-out and resumes from the first unfinished step on retry.
  * **Automatic Descope role provisioning** — Descope roles are now created for orgs and assigned automatically during SCIM sync.

  ## Bug fixes

  * **Login form Enter key** — pressing Enter now submits the login form even when a password-manager browser extension is active.
  * **Logical environment description** — clearing or updating a logical environment description from the settings form now saves correctly.
</Update>

<Update label="July 3, 2026" description="v2.30.1">
  ## Updates

  * Dependency updates (AWS SDK, OPA, gRPC, Google API, and others).

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.30.1)
</Update>

<Update label="July 3, 2026" description="">
  ## New features

  * **Attestation filters** — the org attestations list now supports filters, including a new **decision** entry in the Types filter for control decision attestations.
  * **Single service-account API key endpoint** — new `GET` endpoint to retrieve a specific service-account API key by identifier.

  ## Updates

  * **Faster org trail listings** — flows are now batch-loaded when listing org trails, removing an N+1 query.
  * **Cleaner control decision display** — the internal `system:` prefix is hidden from control decision attestations in the UI.
  * **Org deletion moved to a dedicated task** — long-running org deletion now runs in its own ECS task triggered via EventBridge, improving reliability.
</Update>

<Update label="July 2, 2026" description="v2.30.0">
  ## New features

  * **Controls management (beta)** — new commands to `get`, `list`, `create`, `update`, and `archive` Kosli controls.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.30.0)
</Update>

<Update label="July 2, 2026" description="">
  ## Updates

  * **Filtering and pagination on org attestations API** — the `list_org_attestations` endpoint now accepts filters and paginates results.
</Update>

<Update label="July 1, 2026" description="">
  ## Updates

  * **Approval API endpoints deprecated** — the approval endpoints are now marked deprecated in the API and OpenAPI schema. Existing integrations continue to work, but new work should move off them.
  * **Remembered space selection** — the UI now remembers your selected space(s) between pages using local storage.
</Update>

<Update label="June 29, 2026" description="v2.29.0">
  ## New features

  * **Service account management** — new commands to `create`, `get`, `list`, `update`, and `delete` service accounts: `kosli create service-account`, `kosli get service-account`, `kosli list service-accounts`, `kosli update service-account`, and `kosli delete service-account` (with a confirmation prompt, skippable via `--assume-yes`/`-y`).
  * **Default organization commands** — `kosli update default-org` sets the default organization for the current user, and `kosli get default-org` retrieves it.
  * **New top-level `kosli update` command group** (aliases: `u`, `up`).

  ## Updates

  * `kosli assert snapshot` and `kosli get environment` now report non-compliant environments as `NON-COMPLIANT` (previously `INCOMPLIANT`).

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.29.0)
</Update>

<Update label="June 29, 2026" description="">
  ## Updates

  * **Resume stalled org deletion** — the UI now offers a **Resume** action on a stalled org deletion, so operators can pick up where the previous run left off.
</Update>

<Update label="June 26, 2026" description="">
  ## Updates

  * **Lifecycle status on control version list** — each entry in a control's Version List now shows whether it represents a **Created**, **Edited**, **Archived**, or **Unarchived** event, making history easier to scan.
  * **Consistent Controls list UI** — the Controls Decision List and Version List now use the same card-list layout as the main Controls listing.
</Update>

<Update label="June 25, 2026" description="">
  ## New features

  * **Deployment lead time** — `list` and `get` deployment endpoints now expose `lead_time_seconds`.
</Update>

<Update label="June 24, 2026" description="v2.28.2">
  ## Updates

  * Dependency updates (AWS SDK, Moby Docker client/API, Google API).

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.28.2)
</Update>

<Update label="June 24, 2026" description="">
  ## New features

  * **Archive and unarchive controls** — retired controls can now be archived (and later unarchived) instead of deleted, preserving history while removing them from the active catalog. New `POST /api/v2/controls/{org}/{identifier}/archive` and `unarchive` endpoints, plus UI support.
  * **Controls coverage report** — a new Coverage tab and API show which environments enforce a given control (via a policy whose latest version references it through `for_control`) and which don't.
  * **Filter control decisions by flow** — a control's decisions list can now be filtered by one or more flows.
  * **Controls API in OpenAPI schema (beta)** — the `/api/v2/controls/...` endpoints are now published in the OpenAPI schema, marked beta and gated per-request by the `is-controls-enabled` flag. This unblocks downstream tooling like the Terraform provider.

  ## Updates

  * **Swagger docs can call mutating endpoints again** — requests carrying an `Authorization` header now skip session-CSRF enforcement, so authorized API-key calls from `/api/v2/doc/` no longer fail with `403 CSRF token missing`.
  * **Better flow-template error handling** — invalid flow template YAML now catches a wider range of parser errors instead of returning a 500.
  * **Experimental features opt-in removed** — the unused per-org "experimental features" setting and its API endpoint have been removed.

  ## Bug fixes

  * **Security: SSRF in environment-action webhooks** — webhook and Slack action targets are now validated and re-resolved immediately before each outbound POST, blocking requests to internal infrastructure (loopback, RFC 1918, cloud metadata endpoints, internal Kubernetes services).
  * **Control links with dots in names** — control link names containing `.` are now sanitized for MongoDB storage instead of being rejected.
</Update>

<Update label="June 23, 2026" description="">
  ## New features

  * **`decision` attestation in flow templates** — the `decision` attestation type introduced by Controls is now a first-class option in the flow template system and UI.

  ## Updates

  * **"+ Add tag" affordance on controls with no tags** — the view-control page now shows a clear add-tag button when a control has no tags, instead of a lone kebab menu.
</Update>

<Update label="June 22, 2026" description="v2.28.1">
  ## Updates

  * **Beta status moved to annotations** — `evaluate`, `attest decision`, and related subcommands no longer prefix their short description with `[BETA]`; beta status is now conveyed via annotations and sidebar tags.

  ## Bug fixes

  * **`kosli snapshot ecs` with empty clusters** — fixed a failure (`InvalidParameterException: Services cannot be empty`) when a scanned ECS cluster had no services.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.28.1)
</Update>

<Update label="June 22, 2026" description="">
  ## New features

  * **Membership audit log page** — the membership/role-change history now has a dedicated **Audit Log** page under Settings → User Management, with search, filters (event type, role, source), date range, and sortable columns.
  * **`pull_request` attestation fields** — V2 `pull_request` attestations now carry per-commit `verified` / `signature_state` and a PR `base_ref` (populated by CLI v2.27.0+), enabling Rego policies for signed commits and "merged into main".
  * **Service account CRUD API** — new JSON endpoints under `/service-accounts/{org}` to create, list, get, update, and delete service accounts, complementing the existing API-key endpoints.

  ## Updates

  * **Artifact name on control decisions** — the decisions list and decision tray now show a human-readable artifact name alongside the fingerprint.
  * **Decision list columns** — added **control version** and **attestation name** columns to the decisions list.
  * **Auto-run deletability check** — initiating an org-deletion plan now runs the deletability check automatically, with an approval-blocker warning banner on each plan card when checks fail; the manual button is renamed **Re-check deletability**.
  * **Controls UI refresh** — the controls list, control detail, control edit/new form, and version list pages have been restyled with new layouts, filtering, and interaction improvements.
  * **Faster environment snapshot listing** — `GET /api/v2/snapshots/{org}/{env_name}` (and `kosli list snapshots`) is significantly faster on large/long-lived environments by eliminating per-snapshot ordinal seeks and discarded counts.
  * **Display name fallback** — audit log, controls, and trail views now fall back to `login_name` when a user has no display name set.
  * **Signup form** — the welcome signup form now shows field labels.
  * **Wording** — "Logout" is now "Sign out" across the app.
  * **`base_ref` field placement** — in serialized `pull_request` attestation JSON, `base_ref` now sits next to `head_ref` (cosmetic; key order is not significant).

  ## Bug fixes

  * **Concurrent create 500s** — fixed 500 errors on concurrent `PUT /api/v2/trails/{org}/{flow}` (begin trail) and `PUT /api/v2/policies/{org}/{name}` requests by retrying on duplicate-key races.
  * **"Added" date reset on role change** — fixed a regression where changing a user's role reset their **Added** date (and the service account **Created** date) to today; both now read the original `created_at`.
</Update>

<Update label="June 18, 2026" description="v2.28.0">
  ## New features

  * **`kosli get trail --output markdown`** — `get trail` now supports GitHub-Flavored Markdown output, suitable for piping into CI job summaries (e.g. `$GITHUB_STEP_SUMMARY`). The output includes trail metadata, git commit info, attestation statuses with compliance indicators and links to the Kosli app, and an events table with linked commit SHAs, environment snapshots, and attestation references. See the [get trail reference](/client_reference/kosli_get_trail).

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.28.0)
</Update>

<Update label="June 16, 2026" description="v2.27.0">
  ## New features

  * **`pull_request` attestations capture commit signatures and PR base branch** — each commit now records `verified` and `signature_state` (GitHub and GitLab), and every PR records `base_ref` (GitHub, GitLab, Bitbucket, Azure DevOps), enabling Rego policies for signed commits and "merged into main". Bitbucket and Azure DevOps don't expose per-commit signature verification, so those fields are omitted for them.

  ## Updates

  * **`pull_request` attestation commits** — record the git **author** identity and authored timestamp (not the committer) across all providers.
  * **API key rotation** — failures now clean up the duplicate key ID and include details in the error response.

  <Warning>
    The new `base_ref` field is rejected by Kosli servers older than the matching server change. **Self-hosted users must upgrade their Kosli server before upgrading this CLI**, otherwise `pull_request` attestations will fail validation. Kosli SaaS (app.kosli.com / app.us.kosli.com) is already updated.
  </Warning>

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.27.0)
</Update>

<Update label="June 12, 2026" description="">
  ## New features

  * **Sign in with SSO** — a redesigned sign-in page makes SSO a first-class option alongside other providers.
  * **Membership history audit log** — organization membership and role changes are now appended to an audit history, capturing who changed what and when.
  * **Short fingerprints on artifact GETs** — artifact GET endpoints once again accept short fingerprint prefixes (5–64 chars), restoring documented CLI behavior like `kosli get artifact flow@<short-fingerprint>`.

  ## Updates

  * **Faster org-scoped queries** — trail moments and recently-modified artifact queries now use org-scoped indexes for better performance on large organizations.

  ## Bug fixes

  * Fixed revoking an already-archived service account API key returning `200 OK` instead of `404 Not Found`.
  * Fixed an order-dependent waiver leak in trail and provenance compliance evaluation where one waived exception could incorrectly carry over to later artifacts.
</Update>

<Update label="June 11, 2026" description="v2.26.0">
  ## New features

  * **`kosli list environments` filtering and pagination** — new `--name`, `--type`, `--space-id`, `--tag`, `--page`, and `--page-limit` flags filter and paginate environment listings. See the [list environments reference](/client_reference/kosli_list_environments).
  * **`kosli list flows` name search** — new `--name` and `--ignore-case` flags search flows by name. See the [list flows reference](/client_reference/kosli_list_flows).

  ## Updates

  * **`kosli attest jira`** — clearer help text for CVE and multi-segment identifier filtering behavior. See the [attest jira reference](/client_reference/kosli_attest_jira).

  ## Bug fixes

  * **Service account API key prompts** — the revoke confirmation prompt now reads inline, and cancellation messaging and key ID styling are consistent with other commands.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.26.0)
</Update>

<Update label="June 9, 2026" description="v2.25.0">
  ## New features

  * **`kosli service-account api-keys`** — new command group (alias `sa ak`) to manage service account API keys from the CLI, with `create`, `revoke`, `rotate`, and `list` subcommands.
  * **Short aliases for top-level verbs** — `get` (`g`), `rename` (`re`), `disable` (`dis`), `enable` (`en`), `log` (`lo`), and `status` (`s`, `st`) now have shorter aliases.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.25.0)
</Update>

<Update label="June 4, 2026" description="">
  ## Updates

  * **Consistent "organization" wording** — standardized spelling across user-facing strings in the app.
  * **Simpler invite acceptance** — accepting an invite now requires OTP verification only when the logged-in user's email doesn't match the invitation; matching emails are accepted directly regardless of auth provider.

  ## Bug fixes

  * **Security: service account API keys on public orgs** — fixed a path that could return an arbitrary membership document for unauthenticated callers on public orgs, potentially exposing service account API keys. `is_admin(None)` now always returns `False`.
  * **Flows page** — guarded against a null `space_id` element that could break the flows listing.
  * **Redirects** — all query parameters are now preserved through redirects.
</Update>

<Update label="June 3, 2026" description="">
  ## New features

  * **`for_control` policy compliance** — snapshot compliance now evaluates `for_control` policy requirements. When a policy requires a passing decision attestation for a specific control, the snapshot is checked against a matching decision for that control.

  ## Updates

  * **Assert artifact response includes `for_control`** — the assert artifact API now returns the control identifier in the resolution context for `for_control` rule failures, so clients can show which specific control is unsatisfied.
</Update>

<Update label="June 3, 2026" description="v2.24.2">
  ## New features

  * **`linux/s390x` builds** — the CLI is now published for `linux/s390x` so it can be installed natively on IBM Z hosts.

  ## Bug fixes

  * Bumped Go to 1.26.4 to address standard-library CVEs.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.24.2)
</Update>

<Update label="June 3, 2026" description="v2.24.1">
  ## Updates

  * **`kosli assert artifact`** — when a `for_control` policy rule fails, the failure output now names the specific control identifier that is unsatisfied, making it easier to act on policy failures in CI.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.24.1)
</Update>

<Update label="June 2, 2026" description="v2.24.0">
  ## Updates

  * **SonarQube authentication** — `kosli attest sonar` now falls back to HTTP Basic auth (token as username) on self-hosted SonarQube Server versions earlier than 10.0, which reject `Authorization: Bearer`. The fallback is transparent for self-hosted servers and never applied to SonarCloud. Authentication errors now distinguish 401/403 token or permission problems from 5xx server-availability issues instead of the previous generic "please check your API token" message.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.24.0)
</Update>

<Update label="June 2, 2026" description="">
  ## New features

  * **Default organization on user profile** — pick a default organization from a dropdown on your [profile settings page](https://app.kosli.com/settings/profile) so the Kosli app opens to it on sign-in.

  ## Updates

  * **`visibility` optional when creating flows** — the create-flow API no longer requires a `visibility` field. New flows default to `private`.

  ## Bug fixes

  * Upgraded `libxml2` in the Kosli app image to address CVE-2026-6732 (high-severity denial-of-service in XSD validation).
  * Fixed orphaned tooltips lingering on the page after HTMX-driven updates.
</Update>

<Update label="June 1, 2026" description="v2.23.2">
  ## Bug fixes

  * **`kosli create flow`** — restored the `--visibility` flag as a deprecated (rather than removed) option, so existing scripts that pass it keep working. The flag has no effect on newer Kosli servers and will be removed in a future release. See the [create flow reference](/client_reference/kosli_create_flow).

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.23.2)
</Update>

<Update label="May 30, 2026" description="v2.23.0">
  ## Updates

  * **`kosli create flow`** — the `--visibility` flag is deprecated. Flow visibility now defaults to `private` server-side and the flag is no longer needed.
  * **Deprecation warning for legacy flow creation** — `kosli create flow` now prints a warning when neither `--template-file` nor `--use-empty-template` is supplied. The legacy code path will stop working in a future release; pass a template file or use the empty template instead. See the [create flow reference](/client_reference/kosli_create_flow).

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.23.0)
</Update>

<Update label="May 29, 2026" description="v2.22.1">
  ## Bug fixes

  * Fixed malformed URLs in `kosli list` and `kosli diff` commands when host or path segments contained extra slashes. Requests are now built with proper URL joining.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.22.1)
</Update>

<Update label="May 26, 2026" description="">
  ## New features

  * **Redesigned environments listing page** — the environments page in the Kosli app is now a paginated view with filtering by name, type, and tag, and sorting by last-changed time.
  * **Timestamp filtering on environment events** — the env events API accepts `from` and `to` timestamp query parameters.
  * **Service account privilege management** — admins can change the privilege level of existing service accounts.
  * **API key rotation** — rotate API keys without invalidating existing integrations.

  ## Updates

  * **Faster environments listing** — large environments now load and filter noticeably faster.
  * **Faster trail and snapshot operations** — listing trails and processing snapshots is quicker on large orgs.
  * **OpenAPI improvements** — the API spec has been refined for cleaner SDK generation.
  * **Magic Link login hardening** — added additional protections to the Magic Link sign-in flow.

  ## Bug fixes

  * Fixed empty-digest reports always creating a new snapshot instead of reusing the existing one.
  * Fixed the environments listing not falling back to a user's login name when no display name was set.
  * Fixed an authentication flow issue caused by a trailing slash in default Descope URLs.
</Update>

<Update label="May 26, 2026" description="v2.21.0">
  ## Bug fixes

  * **`kosli attest jira`** — fixed false-positive Jira issue key matches from multi-segment identifiers such as CVE numbers (`CVE-2026-41284` no longer matches as a Jira key). See the [attest jira reference](/client_reference/kosli_attest_jira).
  * **`kosli attest junit`** — JUnit XML ingestion now walks directories recursively, deduplicates file scans, and returns a clearer error message for non-UTF-8 encoded XML files. See the [attest junit reference](/client_reference/kosli_attest_junit).

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.21.0)
</Update>

<Update label="May 14, 2026" description="v2.20.1">
  ## Bug fixes

  * Fixed CLI flags rendering as em dashes in the generated [CLI reference](/client_reference) pages. Flag names (`--flag`, `-x`) are now wrapped in backticks so Mintlify's smart-typography renderer leaves them intact.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.20.1)
</Update>

<Update label="May 13, 2026" description="v2.20.0">
  ## Updates

  * **`kosli approval` commands deprecated** — the `kosli approval` command tree is now marked as deprecated. Use [attestations](/getting_started/attestations) going forward.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.20.0)
</Update>

<Update label="May 12, 2026" description="v2.19.0">
  ## Updates

  * Migrated the Docker client dependency from `github.com/docker/docker` to `github.com/moby/moby` and related modular packages (`moby/moby/api`, `moby/moby/client`).
  * Updated `github.com/open-policy-agent/opa` to v1.16.2.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.19.0)
</Update>

<Update label="May 12, 2026" description="v2.18.0">
  ## New features

  * **`kosli snapshot cloud-run` is now generally available** — the [Cloud Run snapshotter](/client_reference/kosli_snapshot_cloud-run) is no longer hidden and now reports its coverage table alongside the snapshot.
  * **Path filters for `kosli snapshot s3`** — added `--include-regex` and `--exclude-regex` flags to [`kosli snapshot s3`](/client_reference/kosli_snapshot_s3) so you can scope a snapshot to a subset of objects in a bucket.

  ## Bug fixes

  * Fixed `kosli attest snyk` and other SonarQube-backed attestations not forwarding the branch name to SonarQube's `project_analyses/search` endpoint, which previously returned results from the wrong branch.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.18.0)
</Update>

<Update label="May 11, 2026" description="v2.17.8">
  ## New features

  * **Remote policies for `kosli evaluate`** — `--policy` on [`kosli evaluate`](/client_reference/kosli_evaluate_trail) now accepts remote `http(s)` URLs in addition to local file paths, so you can evaluate against centrally-hosted policy files.
  * **`--quiet` flag** — a new global `--quiet` flag suppresses non-essential output from the CLI, useful for scripting and CI pipelines that only care about exit codes.
  * **Expanded Cloud Run support** — [`kosli snapshot cloud-run`](/client_reference/kosli_snapshot_cloud-run) now reports Cloud Run Jobs in addition to services, and recovers missing image digests via a registry lookup when the runtime does not expose them directly.

  ## Bug fixes

  * Fixed bare URLs in CLI flag descriptions producing broken links in the generated reference docs.
  * Fixed the Helm chart docs templates so they render correctly in [Mintlify](/helm).

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.17.8)
</Update>

<Update label="May 11, 2026" description="v0.6.4">
  ## Updates

  * **Toolchain update** — the [Terraform provider](/terraform-reference) is now built with Go 1.26. No user-facing behavior changes.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.6.4)
</Update>

<Update label="May 8, 2026" description="v2.17.7">
  ## New features

  * **Cloud Run Jobs support in `kosli snapshot cloud-run`** — the [Cloud Run snapshotter](/client_reference/kosli_snapshot_cloud-run) can now report Cloud Run Jobs alongside services, and its wire format has been cleaned up.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.17.7)
</Update>

<Update label="May 7, 2026" description="v2.17.6">
  ## Bug fixes

  * Fixed [`kosli snapshot docker`](/client_reference/kosli_snapshot_docker) crashing when it encountered a container that the Docker daemon could not inspect. Such containers are now skipped with a warning and the snapshot continues.
  * Fixed a broken `http-proxy` example link in the CLI reference docs.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.17.6)
</Update>

<Update label="May 4, 2026" description="">
  ## New features

  * **PATCH endpoint for environment updates** — a new `PATCH /environments/{org}/{env_name}` endpoint allows updating individual environment fields without replacing the entire resource. This fixes the issue where setting a description to an empty string was silently ignored, and enables proper support in the [Terraform provider](/terraform-reference/resources/environment).

  ## Updates

  * **Significantly faster environment and snapshot pages** — eliminated thousands of redundant database queries during snapshot reporting and page rendering. For large environments (\~800 artifacts), this removes approximately 5,600 unnecessary database round-trips per snapshot report. The environment events page, which previously took \~60 seconds to load for large environments, now loads normally.
  * **Infinite scroll on snapshot events tab** — the snapshot events tab now loads events incrementally via infinite scroll instead of all at once, improving responsiveness for environments with many events.
  * **Improved environment page search** — search and filter on the environment page now returns all matching artifacts in a single request with loading indicators, fixing broken behavior for large environments.
  * **Faster flow filter lookups** — environment pages that filter by flow now use a pre-materialized collection instead of scanning all artifacts, speeding up load times.
  * **Case-insensitive email lookups** — user and invitation email lookups no longer require exact case matching.
  * **Redirect preserved through login** — when a session expires, the original destination URL (e.g., an org invite page) is now preserved through the logout/login cycle.
  * **API documentation improvements** — the OpenAPI spec title is now "Kosli API", endpoints are sorted alphabetically, and server URLs are absolute for [API playground](/api-reference/actions/list-actions) compatibility.

  ## Bug fixes

  * Fixed the flows filter incorrectly rejecting substring searches starting with hyphens, underscores, dots, or tildes.
  * Fixed the logical environment snapshot events tab raising an error, and the "Running" badge incorrectly counting exited artifacts.
  * Fixed a 500 error when listing API keys with legacy expiration timestamps.
  * Fixed unhandled exceptions during OAuth and SSO sign-in flows.
  * Security: upgraded xz/xz-libs packages to patch CVE-2026-34743.
</Update>

<Update label="May 4, 2026" description="v2.17.5">
  ## Updates

  * **More diagnostic `--debug` output for GitHub calls** — `kosli attest pullrequest github` and other GitHub-backed commands now include the (redacted) `Authorization` header, the resolved proxy URL, and any response body returned alongside transport errors when run with `--debug`. This makes it possible to diagnose corporate proxy and edge filter rejections that previously surfaced only as opaque transport errors.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.17.5)
</Update>

<Update label="May 1, 2026" description="v2.17.4">
  ## Updates

  * **Removed automatic update notifications** — the CLI no longer checks for new versions on every command. The update notice introduced in v2.17.0 occasionally polluted captured output (for example `FP=$(kosli fingerprint ...)`), so version checks now run only for the `version` subcommand and the `--version` flag.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.17.4)
</Update>

<Update label="April 30, 2026" description="v2.17.3">
  ## Updates

  * **Debug logging for GitHub PR attestations** — running `kosli attest pullrequest github` with `--debug` now prints every GitHub REST and GraphQL request and response (method, URL, headers, body) to stderr, with the `Authorization` header redacted. Useful for diagnosing 4xx/5xx responses and eventual-consistency issues in CI. See the [attest pullrequest github](/client_reference/kosli_attest_pullrequest_github) reference.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.17.3)
</Update>

<Update label="April 29, 2026" description="v0.6.3">
  ## Bug fixes

  * **Race condition on environment rename** — renaming a `kosli_environment` or `kosli_logical_environment` resource label while keeping the same `name` no longer fails with a 404 ("Environment has been archived"). The provider now retries the post-create read with bounded backoff and re-asserts desired state when it observes the parallel destroy + create race. If you are intentionally renaming an environment, use `terraform state mv` as documented in the [`kosli_environment`](/terraform-reference/resources/environment) reference.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.6.3)
</Update>

<Update label="April 29, 2026" description="v0.6.2">
  ## Bug fixes

  * **Clearing environment descriptions** — `kosli_environment` and `kosli_logical_environment` updates now use the `PATCH` endpoint, so setting `description = ""` correctly clears the environment's description. The previous `PUT`-based flow silently ignored empty descriptions. See the [`kosli_environment`](/terraform-reference/resources/environment) and [`kosli_logical_environment`](/terraform-reference/resources/logical_environment) references.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.6.2)
</Update>

<Update label="April 29, 2026" description="v2.17.2">
  ## New features

  * **`--assert` / `--no-assert` for evaluate commands** — `kosli evaluate trail`, `kosli evaluate trails`, and `kosli evaluate input` now accept a mutually-exclusive `--assert` / `--no-assert` flag pair. Pass `--no-assert` to use these commands as a policy decision point: the verdict is printed and the command exits 0, leaving any assertion to a downstream step. Default behavior is unchanged — a policy deny still exits non-zero. These commands are now marked `[BETA]`. See the [evaluate trail](/client_reference/kosli_evaluate_trail), [evaluate trails](/client_reference/kosli_evaluate_trails), and [evaluate input](/client_reference/kosli_evaluate_input) references.

  ## Updates

  * Help text for `kosli attest artifact` and `kosli fingerprint` now clarifies that `--artifact-type=docker` requires the image to have been pushed to or pulled from a registry, and points to `--artifact-type=oci` as the preferred alternative for registry-resident images. See the [attest artifact](/client_reference/kosli_attest_artifact) reference.

  ## Bug fixes

  * Reduced API request payload sizes by switching to compact JSON marshalling for both multipart (`--attestation-data`, `--user-data`) and non-multipart request bodies. Multipart payloads no longer hit the server's per-part size limit at \~400-500 KB on disk, and non-multipart bodies are 30-55% smaller on the wire. Debug and dry-run output remains pretty-printed.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.17.2)
</Update>

<Update label="April 23, 2026" description="v2.17.1">
  ## Bug fixes

  * **GitHub PR attestation reliability** — `kosli attest pullrequest github` and `kosli assert pullrequest github` now correctly detect pull requests merged seconds before CI runs. The CLI falls back to a REST + per-PR GraphQL lookup when GitHub's GraphQL `associatedPullRequests` returns no results due to eventual consistency, with retries up to 60 seconds.

  ## Updates

  * Improved help text for `kosli attest artifact` to clarify that `--repo-id`, `--repo-url`, and `--repository` must be set together, and which CI systems set them automatically. See the [attest artifact](/client_reference/kosli_attest_artifact) reference.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.17.1)
</Update>

<Update label="April 21, 2026" description="v0.6.1">
  ## Bug fixes

  * Bumped `hc-install` to v0.9.4 to use the renewed HashiCorp GPG key, restoring provider installation in environments that verify the key.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.6.1)
</Update>

<Update label="April 21, 2026" description="v2.17.0">
  ## New features

  * **Automatic update notifications** — the CLI now checks for available updates after each command and prints a notice to stderr when a newer version is released. Notices are suppressed in debug mode and for commands with programmatic output (e.g. `--output json`).
  * **`kosli --version` enhancements** — `kosli --version` now prints the full version struct and shows an update notice when a newer version is available.

  ## Bug fixes

  * Attestation `--name` validation now rejects names with a leading dot (e.g. `.foo`), trailing dot, or more than one dot (e.g. `foo.bar.baz`) with a clear error message instead of silently mishandling them.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.17.0)
</Update>

<Update label="April 20, 2026" description="">
  ## New features

  * **API key management for service accounts** — programmatically create and manage API keys for service accounts, making it easier to automate integrations.
  * **Filter repositories by name** — the repositories list now supports filtering by name for faster navigation.

  ## Updates

  * Significantly improved environment snapshot page performance, including faster artifact loading, lazy loading, and optimized search.

  ## Bug fixes

  * Fixed a 500 error when listing API keys for keys that had never been used.
  * Fixed YAML syntax errors in policies returning a 500 instead of a 400 error.
  * Fixed snapshot rejection when a repository has no provider set.
</Update>

<Update label="April 20, 2026" description="v2.16.0">
  ## New features

  * **Custom CA bundle support for k8s-reporter** — the [k8s-reporter Helm chart](/helm/k8s_reporter) now supports `extraVolumes`, `extraVolumeMounts`, `extraEnvVars`, and a `customCA` convenience wrapper for environments behind a TLS-inspecting proxy. See the [Helm chart reference](/helm/k8s_reporter) for details.
  * **SonarQube pull request scan support** — `kosli attest sonar` now retrieves scan results for pull request analyses. Pass `--pull-request` to specify the PR number, or let the CLI detect it automatically from the SonarQube metadata file. See the [attest sonar](/client_reference/kosli_attest_sonar) reference.
  * **`--sonar-ce-task-url` flag** — pass the SonarQube CE task URL directly to `kosli attest sonar`, bypassing the need for the `.scannerwork/report-task.txt` file. Useful in CI environments where the scanner and CLI run in separate containers.

  ## Updates

  * The Helm chart now uses `appVersion` as the default CLI version.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.16.0)
</Update>

<Update label="April 15, 2026" description="v0.6.0">
  ## New features

  * **Tags support for environments, logical environments, and flows** — you can now manage tags directly on [`kosli_environment`](/terraform-reference/resources/environment), [`kosli_logical_environment`](/terraform-reference/resources/logical_environment), and [`kosli_flow`](/terraform-reference/resources/flow) resources and their corresponding data sources. Tags are applied as diffs, so only changed tags are sent to the API.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.6.0)
</Update>

<Update label="April 15, 2026" description="v2.15.3">
  ## Updates

  * Updated dependencies across Go libraries, OpenTelemetry SDK, and CI tooling to incorporate the latest security patches and stability improvements.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.15.3)
</Update>

<Update label="April 13, 2026" description="v2.15.2">
  ## Updates

  * **`kosli assert artifact` flag validation** — the `--environment` and `--policy` flags are now validated as mutually exclusive client-side, giving you a faster error message without a server round-trip. The `--flow` flag can be combined with either mode to narrow the artifact lookup scope. See the [assert artifact](/client_reference/kosli_assert_artifact) reference.

  ## Bug fixes

  * Fixed `kosli list repos` and `kosli get repo` displaying garbled text when the latest activity field was empty.
  * Updated dependencies to resolve security vulnerabilities in Go standard library and OpenTelemetry packages.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.15.2)
</Update>

<Update label="April 6, 2026" description="v0.5.0">
  ## New features

  * **`kosli_flow` resource and data source** — manage Kosli [flows](/getting_started/flows) as Terraform resources. Define name, description, and YAML template inline or via `file()`. The data source lets you query existing flows and reuse their templates. See the [resource](/terraform-reference/resources/flow) and [data source](/terraform-reference/data-sources/flow) reference.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.5.0)
</Update>

<Update label="April 6, 2026" description="v2.15.1">
  ## New features

  * **`kosli evaluate input`** — evaluate a local JSON file (or stdin) against a Rego policy with no API dependency. Enables local policy development and fast iteration without a running Kosli server. See the [evaluate input](/client_reference/kosli_evaluate_input) reference.
  * **`--params` flag for policy evaluation** — pass configuration data (thresholds, expected counts, etc.) to Rego policies via `--params` on [`kosli evaluate trail`](/client_reference/kosli_evaluate_trail), [`kosli evaluate trails`](/client_reference/kosli_evaluate_trails), and [`kosli evaluate input`](/client_reference/kosli_evaluate_input). Accepts inline JSON or a file reference. Parameters are available as `data.params` in the policy.
  * **npm installation** — the Kosli CLI is now available as an npm package (`@kosli/cli`), making it easy to install in JavaScript/Node.js toolchains.

  ## Bug fixes

  * Fixed Docker API version negotiation — the CLI now automatically negotiates the Docker API version with the host daemon, preventing compatibility errors after SDK upgrades.
  * Fixed AWS API rate limiting — snapshot commands for ECS, S3, and Lambda environments now use adaptive retry with up to 10 attempts, preventing failures under heavy API load.
  * Fixed git HEAD resolution in linked worktrees.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.15.1)
</Update>

<Update label="April 6, 2026" description="">
  ## New features

  * **Deployment list** — the repository releases page now includes a deployments tab showing a paginated list of deployments with artifact details, commit links, replaced artifacts, and compliance status.
  * **Filter deployments by environment** — filter the deployment list and metrics by specific environments on the repository releases page.

  ## Updates

  * Redesigned the repository run page with improved layout, hover states, and rich tooltips showing artifact fingerprints, snapshot references, and commit details.

  ## Bug fixes

  * Fixed an error when viewing deployment details for artifacts with a missing replaced snapshot index.
</Update>

<Update label="March 30, 2026" description="v2.13.2">
  ## Updates

  * **Removed deprecated `kosli expect deployment` command** — deployment expectation is no longer required for compliance. If your pipelines still reference this command, remove or replace it.
  * **CI-ready Docker image** — a new Alpine-based Dockerfile is available for use as a CI runner image (e.g., GitLab CI), providing the Kosli CLI alongside common CI tooling.

  ## Bug fixes

  * Fixed `kosli get attestation-type` displaying `type_schema` as a Go map instead of formatted JSON.
  * The `--debug` flag now shows the HTML response body when a server error occurs, improving troubleshooting.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.13.2)
</Update>

<Update label="March 30, 2026" description="v0.4.2">
  ## Bug fixes

  * Fixed `type_schema` handling — the provider now correctly reads JSON objects returned by the API, replacing the previous Python repr string workaround.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.4.2)
</Update>

<Update label="March 30, 2026" description="">
  ## New features

  * **Deployment frequency statistics** — the repository releases page now shows a deployment frequency bar chart with daily counts, a median line, and summary statistics for each environment.

  ## Updates

  * Removed the deprecated deployments API. This aligns with the CLI removal of `kosli expect deployment`.
</Update>

<Update label="March 23, 2026" description="v0.4.0">
  ## New features

  * **`kosli_action` resource and data source** — manage webhook notification actions as Terraform resources. Create, update, and import actions by name, and read existing actions to reference in your configurations.
  * **`kosli_policy` resource and data source** — manage Kosli policies as Infrastructure-as-Code. The data source exposes the policy name, description, content, and latest version.
  * **`kosli_policy_attachment` resource** — manage the relationship between policies and environments, letting you attach and detach policies declaratively.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.4.0)
</Update>

<Update label="March 23, 2026" description="v2.13.0">
  ## New features

  * **Repository metadata on attestations** — all `kosli attest` commands and `kosli begin trail` now accept `--repo-id`, `--repository`, `--repo-url`, and `--repo-provider` flags to associate attestations and trails with their source repository. These flags are automatically populated from CI environment variables in GitHub Actions, GitLab CI, Bitbucket Pipelines, Azure DevOps, and CircleCI — no manual configuration needed. See the [CI defaults](/integrations/ci_cd) reference.
  * **Helm chart CronJob configuration** — the [k8s-reporter Helm chart](/helm/k8s_reporter) now lets you configure `concurrencyPolicy`, `failedJobsHistoryLimit`, and `successfulJobsHistoryLimit` for the reporter CronJob.

  ## Updates

  * `--repo-url` is now validated as a well-formed URL when explicitly provided.
  * `--repo-provider` is validated against the allowed values: `github`, `gitlab`, `bitbucket`, `azure-devops`.
  * For `kosli attest pullrequest github` and `kosli attest pullrequest azure`, the `--repository` flag now also controls which repository is queried for pull requests.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.13.0)
</Update>

<Update label="March 23, 2026" description="v2.13.1">
  ## Bug fixes

  * Fixed an issue where artifact names with leading periods were rejected. Leading periods are now trimmed automatically.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.13.1)
</Update>

<Update label="March 23, 2026" description="">
  ## New features

  * **Attestation evidence download** — a new API endpoint lets you download evidence files attached to attestations, making it easier to retrieve and audit attestation data programmatically.
  * **Snapshotter role** — a new [Snapshotter role](/administration/managing_users/roles_in_kosli) is available for users who need to create environment snapshots and manage service accounts without full member permissions. Ideal for environment and operations teams.
</Update>

<Update label="March 16, 2026" description="v2.12.1">
  ## Bug fixes

  * Fixed `kosli attest artifact` sending empty repository information when no repo data is available.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.12.1)
</Update>

<Update label="March 16, 2026" description="v2.12.0">
  ## New features

  * **`kosli evaluate trail` and `kosli evaluate trails`** — evaluate one or more trails against a [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/) policy and get a structured pass/fail decision. Use `--attestations` to filter which attestations are checked, and `--output json` for machine-readable results. Exit code reflects the policy decision, making it ideal for CI/CD gates. See the [evaluate trail](/client_reference/kosli_evaluate_trail) and [evaluate trails](/client_reference/kosli_evaluate_trails) reference for details.
  * **Multi-environment K8s reporting** — `kosli snapshot k8s` now accepts a `--config-file` flag to report multiple Kosli environments in a single command. Define environment-to-namespace mappings in a YAML file instead of running the command once per environment. See the [snapshot k8s](/client_reference/kosli_snapshot_k8s) reference.
  * **Helm chart v2.0.0** — the [k8s-reporter Helm chart](/helm/k8s_reporter) now uses a `reporterConfig.environments` list, enabling multi-environment reporting from a single chart installation. This is a breaking change from v1.x — see the chart README for migration steps.

  [View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.12.0)
</Update>

<Update label="February 18, 2026" description="v0.3.1">
  ## Bug fixes

  * Fixed handling of Python boolean (`true`/`false`) and null values in custom attestation type schemas.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.3.1)
</Update>

<Update label="February 18, 2026" description="v0.3.0">
  ## New features

  * **`kosli_logical_environment` resource** — create and manage logical environments that aggregate multiple physical environments into a single view.
  * **`kosli_logical_environment` data source** — query details of existing logical environments.
  * **Drift detection for logical environments** — Kosli now detects when the `included_environments` of a logical environment change outside of Terraform.
  * **User agent header** — the provider now sends a versioned user agent on every API request, improving diagnostics.

  ## Bug fixes

  * Fixed a missing `flow` field in pull request attestation resources.
  * Fixed `terraform plan` showing `(known after apply)` for the `type` attribute of logical environments instead of `"logical"`.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.3.0)
</Update>

<Update label="January 23, 2026" description="v0.2.0">
  ## New features

  * **`kosli_environment` resource** — create and manage physical Kosli environments (K8S, ECS, S3, docker, server, lambda) as Terraform resources.
  * **`kosli_environment` data source** — query details of existing physical environments.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.2.0)
</Update>

<Update label="January 21, 2026" description="v0.1.0">
  ## Changes

  * `schema` and `jq_rules` are now optional fields on `kosli_attestation_type`, allowing you to create attestation types without a validation schema.

  [View on GitHub](https://github.com/kosli-dev/terraform-provider-kosli/releases/tag/v0.1.0)
</Update>


# kosli
Source: https://docs.kosli.com/client_reference/kosli

The Kosli CLI.

## Synopsis

The Kosli CLI.

Environment variables:
You can set any flag from an environment variable by capitalizing it in snake case and adding the KOSLI\_ prefix.
For example, to set --api-token from an environment variable, you can export KOSLI\_API\_TOKEN=YOUR\_API\_TOKEN.

Setting the API token to DRY\_RUN sets the --dry-run flag.

## Flags

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-h`, `--help`            | bool   | help for kosli                                                                                                                                          |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |


# kosli allow artifact
Source: https://docs.kosli.com/client_reference/kosli_allow_artifact

Add an artifact to an environment's allowlist.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli allow artifact [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Add an artifact to an environment's allowlist.

The artifact fingerprint can be provided directly with the `--fingerprint` flag, or
calculated based on `--artifact-type` flag.

Artifact type can be one of: "file" for files, "dir" for directories, "oci" for container
images in registries or "docker" for local docker images.

Note: `--artifact-type=docker` reads the image's repo digest via the local Docker daemon.
The image must have been pushed to or pulled from a registry for a repo digest to exist;
a freshly built image (just `docker build`) will not have one. If the image is already in
a registry, prefer `--artifact-type=oci`, which fetches the digest directly from the
registry without needing a local Docker daemon.

For `--artifact-type=oci` (and for `--artifact-type=docker` when `--registry-username`
is set), registry credentials are resolved as follows:

1. If `--registry-username` (and optionally `--registry-password`) is set, it is used directly.
2. Otherwise, credentials are discovered automatically from:
   * the Docker config file (`~/.docker/config.json`, populated by `docker login`)
   * the Podman/containers auth file (`~/.config/containers/auth.json`, or `$REGISTRY_AUTH_FILE`)
   * any Docker credential helper configured in that config (e.g. `docker-credential-ecr-login`
     for AWS ECR, `docker-credential-gcloud` for GCR/Artifact Registry, an ACR helper for Azure,
     or a local keychain helper), invoked as an external binary on `$PATH`
   * if none of the above yield credentials, the registry is accessed anonymously, which works
     for public images
     `--registry-provider` is deprecated and no longer used.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

## Flags

| Flag                    | Type    | Description                                                                                                                                                                                                                                            |
| :---------------------- | :------ | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-t`, `--artifact-type` | string  | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).       |
| `-D`, `--dry-run`       | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                   |
| `-e`, `--environment`   | string  | The environment name for which the artifact is allowlisted.                                                                                                                                                                                            |
| `-x`, `--exclude`       | strings | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                       |
| `-F`, `--fingerprint`   | string  | \[conditional] The SHA256 fingerprint of the artifact. Only required if you don't specify '`--artifact-type`'.                                                                                                                                         |
| `-h`, `--help`          | bool    | help for artifact                                                                                                                                                                                                                                      |
| `--reason`              | string  | The reason why this artifact is allowlisted.                                                                                                                                                                                                           |
| `--registry-password`   | string  | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
| `--registry-provider`   | string  | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                            |
| `--registry-username`   | string  | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                 |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |


# kosli archive attestation-type
Source: https://docs.kosli.com/client_reference/kosli_archive_attestation-type

Archive a custom Kosli attestation type.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli archive attestation-type TYPE-NAME [flags]
```

Archive a custom Kosli attestation type.
New custom attestations using this type cannot be made, but existing attestations will still be visible.

## Flags

| Flag              | Type | Description                                                                                                                          |
| :---------------- | :--- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool | help for attestation-type                                                                                                            |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="archive a Kosli custom attestation type">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli archive attestation-type yourAttestationTypeName 
    ```
  </Accordion>
</AccordionGroup>


# kosli archive control
Source: https://docs.kosli.com/client_reference/kosli_archive_control

Archive a Kosli control.

<Warning>
  This is a beta feature. Beta features provide early access to product
  functionality. These features may change between releases without warning, or
  can be removed in a future release. Please contact us to enable this feature
  for your organization.
</Warning>

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli archive control CONTROL-IDENTIFIER [flags]
```

Archive a Kosli control.
An archived control is no longer active. It remains visible via `kosli get control` and
via `kosli list controls --archived`, and can be restored with `kosli unarchive control`.

## Flags

| Flag              | Type | Description                                                                                                                          |
| :---------------- | :--- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool | help for control                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="archive a Kosli control">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli archive control yourControlIdentifier 
    ```
  </Accordion>
</AccordionGroup>


# kosli archive environment
Source: https://docs.kosli.com/client_reference/kosli_archive_environment

Archive a Kosli environment.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli archive environment ENVIRONMENT-NAME [flags]
```

Archive a Kosli environment.
The environment will no longer be visible in list of environments, data is still stored in the database.

## Flags

| Flag              | Type | Description                                                                                                                          |
| :---------------- | :--- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool | help for environment                                                                                                                 |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="archive a Kosli environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli archive environment yourEnvironmentName 
    ```
  </Accordion>
</AccordionGroup>


# kosli archive flow
Source: https://docs.kosli.com/client_reference/kosli_archive_flow

Archive a Kosli flow.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli archive flow FLOW-NAME [flags]
```

Archive a Kosli flow.
The flow will no longer be visible in list of flows, data is still stored in the database.

## Flags

| Flag              | Type | Description                                                                                                                          |
| :---------------- | :--- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool | help for flow                                                                                                                        |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="archive a Kosli flow">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli archive flow yourFlowName 
    ```
  </Accordion>
</AccordionGroup>


# kosli assert artifact
Source: https://docs.kosli.com/client_reference/kosli_assert_artifact

Assert the compliance status of an artifact in Kosli.  There are three ways to choose what to assert against:
1. Against an environment. When `--environment` is specified, asserts against all poli...

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert artifact [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Assert the compliance status of an artifact in Kosli.
There are three ways to choose what to assert against:

1. Against an environment. When `--environment` is specified,
   asserts against all policies currently attached to the given environment.
2. Against one or more policies. When `--policy` is specified,
   asserts against all the given policies.
3. Against flow templates. When neither `--environment` nor `--policy`
   is specified, asserts against the template files of the flows the artifact
   is found in.

`--environment` and `--policy` are mutually exclusive.

`--flow` can be combined with any of the above to narrow the lookup
to a specific flow. Without `--flow`, all flows containing the artifact
(by fingerprint) are considered.

Exits with zero code if the artifact has compliant status,
non-zero code if non-compliant status.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

## Flags

| Flag                    | Type    | Description                                                                                                                                                                                                                                            |
| :---------------------- | :------ | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-t`, `--artifact-type` | string  | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).       |
| `-D`, `--dry-run`       | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                   |
| `--environment`         | string  | The Kosli environment name to assert the artifact against.                                                                                                                                                                                             |
| `-x`, `--exclude`       | strings | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                       |
| `-F`, `--fingerprint`   | string  | \[conditional] The SHA256 fingerprint of the artifact. Only required if you don't specify '`--artifact-type`'.                                                                                                                                         |
| `-f`, `--flow`          | string  | The Kosli flow name.                                                                                                                                                                                                                                   |
| `-h`, `--help`          | bool    | help for artifact                                                                                                                                                                                                                                      |
| `-o`, `--output`        | string  | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")                                                                                                                                                            |
| `--policy`              | strings | \[optional] policy name (can be specified multiple times)                                                                                                                                                                                              |
| `--registry-password`   | string  | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
| `--registry-provider`   | string  | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                            |
| `--registry-username`   | string  | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                 |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli assert artifact` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/differ/blob/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de/.github/workflows/main.yml#L271)
  </Tab>

  <Tab title="GitLab">
    View an example of the `kosli assert artifact` command in GitLab.

    In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/42876c4da26ee74e4bbfe14c2949cc7cb2d3345e/.gitlab/workflows/main.yml#L158)
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="assert that an artifact meets all compliance requirements for an environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli assert artifact 
    	--fingerprint 184c799cd551dd1d8d5c5f9a5d593b2e931f5e36122ee5c793c1d08a19839cc0 
    	--environment prod 

    ```
  </Accordion>

  <Accordion title="assert that an artifact meets a set of policies">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli assert artifact 
    	--fingerprint 184c799cd551dd1d8d5c5f9a5d593b2e931f5e36122ee5c793c1d08a19839cc0 
    	--policy has-approval,has-been-integration-tested 

    ```
  </Accordion>

  <Accordion title="fail if an artifact has a non-compliant status in a single flow (using the artifact fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export KOSLI_FLOW=yourFlowName
    kosli assert artifact 
    	--fingerprint 184c799cd551dd1d8d5c5f9a5d593b2e931f5e36122ee5c793c1d08a19839cc0 

    ```
  </Accordion>

  <Accordion title="fail if an artifact has a non-compliant status in any flow (using the artifact name and type)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    unset KOSLI_FLOW
    kosli assert artifact library/nginx:1.21 
    	--artifact-type docker 
    ```
  </Accordion>
</AccordionGroup>


# kosli assert pullrequest azure
Source: https://docs.kosli.com/client_reference/kosli_assert_pullrequest_azure

Assert an Azure DevOps pull request for a git commit exists.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert pullrequest azure [flags]
```

Assert an Azure DevOps pull request for a git commit exists.\
The command exits with non-zero exit code
if no pull requests were found for the commit.

## Flags

| Flag              | Type   | Description                                                                                                                                        |
| :---------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--azure-org-url` | string | Azure organization url. E.g. `https://dev.azure.com/myOrg` (defaulted if you are running in Azure Devops pipelines: [docs](/integrations/ci_cd) ). |
| `--azure-token`   | string | Azure Personal Access token.                                                                                                                       |
| `--commit`        | string | Git commit for which to find pull request evidence. (defaulted in some CIs: [docs](/integrations/ci_cd) ). (default "HEAD")                        |
| `-D`, `--dry-run` | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.               |
| `-h`, `--help`    | bool   | help for azure                                                                                                                                     |
| `--project`       | string | Azure project.(defaulted if you are running in Azure Devops pipelines: [docs](/integrations/ci_cd) ).                                              |
| `--repository`    | string | Git repository. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                             |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert pullrequest azure \
	--azure-token yourAzureToken \
	--azure-org-url yourAzureOrgUrl \
	--commit yourGitCommit \
	--project yourAzureDevopsProject \
	--repository yourAzureDevOpsGitRepository
```


# kosli assert pullrequest bitbucket
Source: https://docs.kosli.com/client_reference/kosli_assert_pullrequest_bitbucket

Assert a Bitbucket pull request for a git commit exists.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert pullrequest bitbucket [flags]
```

Assert a Bitbucket pull request for a git commit exists.\
The command exits with non-zero exit code if no pull requests were found for the commit.
Authentication to Bitbucket can be done with an access token (recommended) or an Atlassian API token, passed via --bitbucket-username (your Atlassian account email) and --bitbucket-password.
Bitbucket app passwords are no longer supported as of 28 July 2026; replace any app passwords with API tokens. Credentials need to have read access for both repos and pull requests.

## Flags

| Flag                       | Type   | Description                                                                                                                                                                                                           |
| :------------------------- | :----- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--bitbucket-access-token` | string | Bitbucket repo/project/workspace access token. See [Bitbucket access tokens](https://developer.atlassian.com/cloud/bitbucket/rest/intro/#access-tokens) for more details.                                             |
| `--bitbucket-password`     | string | Bitbucket API token. Bitbucket app passwords are no longer supported as of 28 July 2026. See [Bitbucket authentication](https://developer.atlassian.com/cloud/bitbucket/rest/intro/#authentication) for more details. |
| `--bitbucket-username`     | string | Bitbucket username (your Atlassian account email when using an API token). Only needed if you use `--bitbucket-password`                                                                                              |
| `--bitbucket-workspace`    | string | Bitbucket workspace ID.                                                                                                                                                                                               |
| `--commit`                 | string | Git commit for which to find pull request evidence. (defaulted in some CIs: [docs](/integrations/ci_cd) ). (default "HEAD")                                                                                           |
| `-D`, `--dry-run`          | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                  |
| `-h`, `--help`             | bool   | help for bitbucket                                                                                                                                                                                                    |
| `--repository`             | string | Git repository. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                                                |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert pullrequest bitbucket  \
	--bitbucket-access-token yourBitbucketAccessToken \
	--bitbucket-workspace yourBitbucketWorkspace \
	--commit yourGitCommit \
	--repository yourBitbucketGitRepository
```


# kosli assert pullrequest github
Source: https://docs.kosli.com/client_reference/kosli_assert_pullrequest_github

Assert a Github pull request for a git commit exists.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert pullrequest github [flags]
```

Assert a Github pull request for a git commit exists.\
The command exits with non-zero exit code
if no pull requests were found for the commit.

## Flags

| Flag                | Type   | Description                                                                                                                          |
| :------------------ | :----- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `--commit`          | string | Git commit for which to find pull request evidence. (defaulted in some CIs: [docs](/integrations/ci_cd) ). (default "HEAD")          |
| `-D`, `--dry-run`   | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `--github-base-url` | string | \[optional] GitHub base URL (only needed for GitHub Enterprise installations).                                                       |
| `--github-org`      | string | Github organization. (defaulted if you are running in GitHub Actions: [docs](/integrations/ci_cd) ).                                 |
| `--github-token`    | string | Github token.                                                                                                                        |
| `-h`, `--help`      | bool   | help for github                                                                                                                      |
| `--repository`      | string | Git repository. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                               |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert pullrequest github \
	--github-token yourGithubToken \
	--github-org yourGithubOrg \
	--commit yourGitCommit \
	--repository yourGithubGitRepository
```


# kosli assert pullrequest gitlab
Source: https://docs.kosli.com/client_reference/kosli_assert_pullrequest_gitlab

Assert a Gitlab merge request for a git commit exists.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert pullrequest gitlab [flags]
```

Assert a Gitlab merge request for a git commit exists.\
The command exits with non-zero exit code
if no merge requests were found for the commit.

## Flags

| Flag                | Type   | Description                                                                                                                          |
| :------------------ | :----- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `--commit`          | string | Git commit for which to find pull request evidence. (defaulted in some CIs: [docs](/integrations/ci_cd) ). (default "HEAD")          |
| `-D`, `--dry-run`   | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `--gitlab-base-url` | string | \[optional] Gitlab base URL (only needed for on-prem Gitlab installations).                                                          |
| `--gitlab-org`      | string | Gitlab organization. (defaulted if you are running in Gitlab Pipelines: [docs](/integrations/ci_cd) ).                               |
| `--gitlab-token`    | string | Gitlab token.                                                                                                                        |
| `-h`, `--help`      | bool   | help for gitlab                                                                                                                      |
| `--repository`      | string | Git repository. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                               |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert mergerequest gitlab \
	--github-token yourGithubToken \
	--github-org yourGithubOrg \
	--commit yourGitCommit \
	--repository yourGithubGitRepository
```


# kosli assert snapshot
Source: https://docs.kosli.com/client_reference/kosli_assert_snapshot

Assert the compliance status of an environment in Kosli.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert snapshot ENVIRONMENT-NAME-OR-EXPRESSION [flags]
```

Assert the compliance status of an environment in Kosli.
Exits with non-zero code if the environment has a non-compliant status.
The expected argument is an expression to specify the specific environment snapshot to assert.
It has the format `ENVIRONMENT_NAME`\[SEPARATOR]\[SNAPSHOT\_REFERENCE]

Separators can be:

* '#' to specify a specific snapshot number for the environment that is being asserted.
* '\~' to get N-th behind the latest snapshot.

Examples of valid expressions are:

* prod (latest snapshot of prod)
* prod#10 (snapshot number 10 of prod)
* prod\~2 (third latest snapshot of prod)

## Flags

| Flag              | Type | Description                                                                                                                          |
| :---------------- | :--- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool | help for snapshot                                                                                                                    |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert snapshot prod#5 \
	--api-token yourAPIToken \
	--org yourOrgName
```


# kosli assert status
Source: https://docs.kosli.com/client_reference/kosli_assert_status

Assert the status of a Kosli server.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert status [flags]
```

Assert the status of a Kosli server.
Exits with non-zero code if the Kosli server down.

## Flags

| Flag           | Type | Description     |
| :------------- | :--- | :-------------- |
| `-h`, `--help` | bool | help for status |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |


# kosli attach-policy
Source: https://docs.kosli.com/client_reference/kosli_attach-policy

Attach a policy to one or more Kosli environments.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attach-policy POLICY-NAME [flags]
```

Attach a policy to one or more Kosli environments.

## Flags

| Flag                  | Type    | Description                                                                                                                          |
| :-------------------- | :------ | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run`     | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-e`, `--environment` | strings | the list of environment names to attach the policy to                                                                                |
| `-h`, `--help`        | bool    | help for attach-policy                                                                                                               |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="attach a previously created policy to multiple environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attach-policy yourPolicyName 
    	--environment yourFirstEnvironmentName 
    	--environment yourSecondEnvironmentName 
    ```
  </Accordion>
</AccordionGroup>


# kosli attest artifact
Source: https://docs.kosli.com/client_reference/kosli_attest_artifact

Attest an artifact creation to a Kosli flow.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest artifact {IMAGE-NAME | FILE-PATH | DIR-PATH} [flags]
```

Attest an artifact creation to a Kosli flow.

The artifact fingerprint can be provided directly with the `--fingerprint` flag, or
calculated based on `--artifact-type` flag.

Artifact type can be one of: "file" for files, "dir" for directories, "oci" for container
images in registries or "docker" for local docker images.

Note: `--artifact-type=docker` reads the image's repo digest via the local Docker daemon.
The image must have been pushed to or pulled from a registry for a repo digest to exist;
a freshly built image (just `docker build`) will not have one. If the image is already in
a registry, prefer `--artifact-type=oci`, which fetches the digest directly from the
registry without needing a local Docker daemon.

For `--artifact-type=oci` (and for `--artifact-type=docker` when `--registry-username`
is set), registry credentials are resolved as follows:

1. If `--registry-username` (and optionally `--registry-password`) is set, it is used directly.
2. Otherwise, credentials are discovered automatically from:
   * the Docker config file (`~/.docker/config.json`, populated by `docker login`)
   * the Podman/containers auth file (`~/.config/containers/auth.json`, or `$REGISTRY_AUTH_FILE`)
   * any Docker credential helper configured in that config (e.g. `docker-credential-ecr-login`
     for AWS ECR, `docker-credential-gcloud` for GCR/Artifact Registry, an ACR helper for Azure,
     or a local keychain helper), invoked as an external binary on `$PATH`
   * if none of the above yield credentials, the registry is accessed anonymously, which works
     for public images
     `--registry-provider` is deprecated and no longer used.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.
This command requires access to a git repo to associate the artifact to the git commit it is originating from.
You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
In other CI systems, set them explicitly to capture repository metadata.

## Flags

| Flag                     | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :----------------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--annotate`             | stringToString | \[optional] Annotate the attestation with data using key=value.                                                                                                                                                                                                                                                                                 |
| `-t`, `--artifact-type`  | string         | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).                                                                                                |
| `-b`, `--build-url`      | string         | The url of CI pipeline that built the artifact. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                                                                                                                                          |
| `-g`, `--commit`         | string         | \[defaulted] The git commit from which the artifact was created. (defaulted in some CIs: [docs](/integrations/ci_cd), otherwise defaults to HEAD ). (default "HEAD")                                                                                                                                                                            |
| `-u`, `--commit-url`     | string         | The url for the git commit that created the artifact. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                                                                                                                                    |
| `-N`, `--display-name`   | string         | \[optional] Artifact display name, if different from file, image or directory name.                                                                                                                                                                                                                                                             |
| `-D`, `--dry-run`        | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `-x`, `--exclude`        | strings        | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                                                                                                                |
| `--external-fingerprint` | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`         | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `-F`, `--fingerprint`    | string         | \[conditional] The SHA256 fingerprint of the artifact. Only required if you don't specify '`--artifact-type`'.                                                                                                                                                                                                                                  |
| `-f`, `--flow`           | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `-h`, `--help`           | bool           | help for artifact                                                                                                                                                                                                                                                                                                                               |
| `-n`, `--name`           | string         | The name of the artifact in the yml template file.                                                                                                                                                                                                                                                                                              |
| `--redact-commit-info`   | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--registry-password`    | string         | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                          |
| `--registry-provider`    | string         | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                                                                                                                     |
| `--registry-username`    | string         | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                                          |
| `--repo-id`              | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`        | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`            | string         | \[defaulted] The directory where the source git repository is available. (default ".")                                                                                                                                                                                                                                                          |
| `--repo-url`             | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`           | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `-T`, `--trail`          | string         | The Kosli trail name.                                                                                                                                                                                                                                                                                                                           |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli attest artifact` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/reusable-actions-workflows/blob/25f0b797c18403de1c8490a9a71bbe9789c809a9/.github/workflows/secure-docker-build.yml#L210), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de?attestation_id=11345222-f37a-4f8d-8051-ec26a321).
  </Tab>

  <Tab title="GitLab">
    View an example of the `kosli attest artifact` command in GitLab.

    In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L111), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/d64d2b11879179255f11dc991e81fbaf4a040264?attestation_id=61384b36-4d32-43f2-8d5d-a72e2e7e).
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="Attest that a file type artifact has been created, and let Kosli calculate its fingerprint">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest artifact FILE.tgz 
    	--artifact-type file 
    	--build-url https://exampleci.com 
    	--commit-url https://github.com/YourOrg/YourProject/commit/yourCommitShaThatThisArtifactWasBuiltFrom 
    	--commit yourCommitShaThatThisArtifactWasBuiltFrom 
    	--name yourTemplateArtifactName 


    ```
  </Accordion>

  <Accordion title="Attest that an artifact has been created and provide its fingerprint (sha256)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest artifact ANOTHER_FILE.txt 
    	--build-url https://exampleci.com 
    	--commit-url https://github.com/YourOrg/YourProject/commit/yourCommitShaThatThisArtifactWasBuiltFrom 
    	--commit yourCommitShaThatThisArtifactWasBuiltFrom 
    	--fingerprint yourArtifactFingerprint 
    	--name yourTemplateArtifactName 

    ```
  </Accordion>

  <Accordion title="Attest that an artifact has been created and provide external attachments">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest artifact ANOTHER_FILE.txt 
    	--build-url https://exampleci.com 
    	--commit-url https://github.com/YourOrg/YourProject/commit/yourCommitShaThatThisArtifactWasBuiltFrom 
    	--commit yourCommitShaThatThisArtifactWasBuiltFrom 
    	--fingerprint yourArtifactFingerprint 
    	--external-url label=https://example.com/attachment 
    	--external-fingerprint label=yourExternalAttachmentFingerprint 
    	--name yourTemplateArtifactName 
    ```
  </Accordion>
</AccordionGroup>


# kosli attest custom
Source: https://docs.kosli.com/client_reference/kosli_attest_custom

Report a custom attestation to an artifact or a trail in a Kosli flow. 

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest custom [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Report a custom attestation to an artifact or a trail in a Kosli flow.
The name of the custom attestation type is specified using the `--type` flag.
The path to the JSON file the custom type will evaluate is specified using the `--attestation-data` flag.

The attestation can be bound to a *trail* using the trail name.
The attestation can be bound to an *artifact* in two ways:

* using the artifact's SHA256 fingerprint which is calculated (based on the `--artifact-type` flag and the artifact name/path argument) or can be provided directly (with the `--fingerprint` flag).
* using the artifact's name in the flow yaml template and the git commit from which the artifact is/will be created. Useful when reporting an attestation before creating/reporting the artifact.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
binding the attestation to the right artifact.
To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
In other CI systems, set them explicitly to capture repository metadata.

## Flags

| Flag                     | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :----------------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--annotate`             | stringToString | \[optional] Annotate the attestation with data using key=value.                                                                                                                                                                                                                                                                                 |
| `-t`, `--artifact-type`  | string         | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).                                                                                                |
| `--attachments`          | strings        | \[optional] The comma-separated list of paths of attachments for the reported attestation. Attachments can be files or directories. All attachments are compressed and uploaded to Kosli's evidence vault.                                                                                                                                      |
| `--attestation-data`     | string         | The filepath of a json file containing the custom attestation data.                                                                                                                                                                                                                                                                             |
| `-g`, `--commit`         | string         | \[conditional] The git commit for which the attestation is associated to. Becomes required when reporting an attestation for an artifact before reporting it to Kosli. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                   |
| `--description`          | string         | \[optional] attestation description                                                                                                                                                                                                                                                                                                             |
| `-D`, `--dry-run`        | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `-x`, `--exclude`        | strings        | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                                                                                                                |
| `--external-fingerprint` | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`         | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `-F`, `--fingerprint`    | string         | \[conditional] The SHA256 fingerprint of the artifact to attach the attestation to. Only required if the attestation is for an artifact and `--artifact-type` and artifact name/path are not used.                                                                                                                                              |
| `-f`, `--flow`           | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `-h`, `--help`           | bool           | help for custom                                                                                                                                                                                                                                                                                                                                 |
| `-n`, `--name`           | string         | The name of the attestation as declared in the flow or trail yaml template.                                                                                                                                                                                                                                                                     |
| `-o`, `--origin-url`     | string         | \[optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).                                                                                                                                            |
| `--redact-commit-info`   | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--registry-password`    | string         | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                          |
| `--registry-provider`    | string         | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                                                                                                                     |
| `--registry-username`    | string         | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                                          |
| `--repo-id`              | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`        | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`            | string         | \[defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")                                                                                                                   |
| `--repo-url`             | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`           | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `-T`, `--trail`          | string         | The Kosli trail name.                                                                                                                                                                                                                                                                                                                           |
| `--type`                 | string         | The name of the custom attestation type.                                                                                                                                                                                                                                                                                                        |
| `-u`, `--user-data`      | string         | \[optional] The path to a JSON file containing additional data you would like to attach to the attestation.                                                                                                                                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli attest custom` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/differ/blob/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de/.github/workflows/main.yml#L168), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de?attestation_id=8dfb2b55-0e6d-4d76-8396-4c85e9aa).
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report a custom attestation about a pre-built container image artifact (kosli finds the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest custom yourDockerImageName 
    	--artifact-type oci 
    	--type customTypeName 
    	--name yourAttestationName 
    	--attestation-data yourJsonFilePath 

    ```
  </Accordion>

  <Accordion title="report a custom attestation about a pre-built docker artifact (you provide the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest custom 
    	--fingerprint yourDockerImageFingerprint 
    	--type customTypeName 
    	--name yourAttestationName 
    	--attestation-data yourJsonFilePath 

    ```
  </Accordion>

  <Accordion title="report a custom attestation about a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest custom 
    	--type customTypeName 
    	--name yourAttestationName 
    	--attestation-data yourJsonFilePath 

    ```
  </Accordion>

  <Accordion title="report a custom attestation about an artifact which has not been reported yet in a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest custom 
    	--type customTypeName 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--attestation-data yourJsonFilePath 
    	--commit yourArtifactGitCommit 

    ```
  </Accordion>

  <Accordion title="report a custom attestation about a trail with an attachment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest custom 
        --type customTypeName 
    	--name yourAttestationName 
    	--attestation-data yourJsonFilePath 
    	--attachments yourAttachmentPathName 
    ```
  </Accordion>
</AccordionGroup>


# kosli attest decision
Source: https://docs.kosli.com/client_reference/kosli_attest_decision

Record a compliance decision against a control in a Kosli trail.  

<Warning>
  This is a beta feature. Beta features provide early access to product
  functionality. These features may change between releases without warning, or
  can be removed in a future release. Please contact us to enable this feature
  for your organization.
</Warning>

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest decision [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Record a compliance decision against a control in a Kosli trail.\
Use this command to record the outcome of evaluating a control as part of your delivery
pipeline — whether it was satisfied or not — attached to a specific trail with an optional artifact.
This decision is the evidence that a governance requirement was assessed.

The attestation can be bound to a *trail* using the trail name.
The attestation can be bound to an *artifact* in two ways:

* using the artifact's SHA256 fingerprint which is calculated (based on the `--artifact-type` flag and the artifact name/path argument) or can be provided directly (with the `--fingerprint` flag).
* using the artifact's name in the flow yaml template and the git commit from which the artifact is/will be created. Useful when reporting an attestation before creating/reporting the artifact.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
binding the attestation to the right artifact.
To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
In other CI systems, set them explicitly to capture repository metadata.

## Flags

| Flag                     | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :----------------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--annotate`             | stringToString | \[optional] Annotate the attestation with data using key=value.                                                                                                                                                                                                                                                                                 |
| `-t`, `--artifact-type`  | string         | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).                                                                                                |
| `--attachments`          | strings        | \[optional] The comma-separated list of paths of attachments for the reported attestation. Attachments can be files or directories. All attachments are compressed and uploaded to Kosli's evidence vault.                                                                                                                                      |
| `-g`, `--commit`         | string         | \[conditional] The git commit for which the attestation is associated to. Becomes required when reporting an attestation for an artifact before reporting it to Kosli. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                   |
| `-C`, `--compliant`      | bool           | \[defaulted] Whether the attestation is compliant or not.                                                                                                                                                                                                                                                                                       |
| `--control`              | string         | The control identifier being evaluated (e.g. RCTL-043).                                                                                                                                                                                                                                                                                         |
| `--description`          | string         | \[optional] attestation description                                                                                                                                                                                                                                                                                                             |
| `-D`, `--dry-run`        | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `-x`, `--exclude`        | strings        | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                                                                                                                |
| `--external-fingerprint` | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`         | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `-F`, `--fingerprint`    | string         | \[conditional] The SHA256 fingerprint of the artifact to attach the attestation to. Only required if the attestation is for an artifact and `--artifact-type` and artifact name/path are not used.                                                                                                                                              |
| `-f`, `--flow`           | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `-h`, `--help`           | bool           | help for decision                                                                                                                                                                                                                                                                                                                               |
| `-n`, `--name`           | string         | The name of the attestation as declared in the flow or trail yaml template.                                                                                                                                                                                                                                                                     |
| `-o`, `--origin-url`     | string         | \[optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).                                                                                                                                            |
| `--redact-commit-info`   | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--registry-password`    | string         | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                          |
| `--registry-provider`    | string         | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                                                                                                                     |
| `--registry-username`    | string         | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                                          |
| `--repo-id`              | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`        | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`            | string         | \[defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")                                                                                                                   |
| `--repo-url`             | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`           | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `-T`, `--trail`          | string         | The Kosli trail name.                                                                                                                                                                                                                                                                                                                           |
| `-u`, `--user-data`      | string         | \[optional] The path to a JSON file containing additional data you would like to attach to the attestation.                                                                                                                                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="record a compliant decision against a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest decision 
    	--name yourAttestationName 
    	--control RCTL-043 
    	--compliant=true 

    ```
  </Accordion>

  <Accordion title="record a non-compliant decision against a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest decision 
    	--name yourAttestationName 
    	--control RCTL-043 
    	--compliant=false 

    ```
  </Accordion>

  <Accordion title="record a decision linked to a specific artifact (by fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest decision 
    	--name yourAttestationName 
    	--control RCTL-043 
    	--compliant=true 
    	--fingerprint yourArtifactFingerprint 

    ```
  </Accordion>

  <Accordion title="record a decision with an evidence attachment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest decision 
    	--name yourAttestationName 
    	--control RCTL-043 
    	--compliant=true 
    	--attachments eval-report.json 
    ```
  </Accordion>
</AccordionGroup>


# kosli attest generic
Source: https://docs.kosli.com/client_reference/kosli_attest_generic

Report a generic attestation to an artifact or a trail in a Kosli flow.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest generic [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Report a generic attestation to an artifact or a trail in a Kosli flow.

The attestation can be bound to a *trail* using the trail name.
The attestation can be bound to an *artifact* in two ways:

* using the artifact's SHA256 fingerprint which is calculated (based on the `--artifact-type` flag and the artifact name/path argument) or can be provided directly (with the `--fingerprint` flag).
* using the artifact's name in the flow yaml template and the git commit from which the artifact is/will be created. Useful when reporting an attestation before creating/reporting the artifact.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
binding the attestation to the right artifact.
To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
In other CI systems, set them explicitly to capture repository metadata.

## Flags

| Flag                     | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :----------------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--annotate`             | stringToString | \[optional] Annotate the attestation with data using key=value.                                                                                                                                                                                                                                                                                 |
| `-t`, `--artifact-type`  | string         | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).                                                                                                |
| `--attachments`          | strings        | \[optional] The comma-separated list of paths of attachments for the reported attestation. Attachments can be files or directories. All attachments are compressed and uploaded to Kosli's evidence vault.                                                                                                                                      |
| `-g`, `--commit`         | string         | \[conditional] The git commit for which the attestation is associated to. Becomes required when reporting an attestation for an artifact before reporting it to Kosli. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                   |
| `-C`, `--compliant`      | bool           | \[defaulted] Whether the attestation is compliant or not. (default true)                                                                                                                                                                                                                                                                        |
| `--description`          | string         | \[optional] attestation description                                                                                                                                                                                                                                                                                                             |
| `-D`, `--dry-run`        | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `-x`, `--exclude`        | strings        | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                                                                                                                |
| `--external-fingerprint` | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`         | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `-F`, `--fingerprint`    | string         | \[conditional] The SHA256 fingerprint of the artifact to attach the attestation to. Only required if the attestation is for an artifact and `--artifact-type` and artifact name/path are not used.                                                                                                                                              |
| `-f`, `--flow`           | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `-h`, `--help`           | bool           | help for generic                                                                                                                                                                                                                                                                                                                                |
| `-n`, `--name`           | string         | The name of the attestation as declared in the flow or trail yaml template.                                                                                                                                                                                                                                                                     |
| `-o`, `--origin-url`     | string         | \[optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).                                                                                                                                            |
| `--redact-commit-info`   | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--registry-password`    | string         | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                          |
| `--registry-provider`    | string         | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                                                                                                                     |
| `--registry-username`    | string         | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                                          |
| `--repo-id`              | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`        | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`            | string         | \[defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")                                                                                                                   |
| `--repo-url`             | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`           | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `-T`, `--trail`          | string         | The Kosli trail name.                                                                                                                                                                                                                                                                                                                           |
| `-u`, `--user-data`      | string         | \[optional] The path to a JSON file containing additional data you would like to attach to the attestation.                                                                                                                                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli attest generic` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/dashboard/blob/ff9f292e809801d35246183988b7812826bc2760/.github/workflows/main.yml#L198), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/dashboard-ci/trails/ff9f292e809801d35246183988b7812826bc2760?attestation_id=dcf20aee-975c-4b20-9d25-02c789f8).
  </Tab>

  <Tab title="GitLab">
    View an example of the `kosli attest generic` command in GitLab.

    In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L131), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/d64d2b11879179255f11dc991e81fbaf4a040264?attestation_id=b72fe1fe-90da-4738-a506-d803f5a6).
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report a generic attestation about a pre-built docker artifact (kosli calculates the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest generic yourDockerImageName 
    	--artifact-type docker 
    	--name yourAttestationName 

    ```
  </Accordion>

  <Accordion title="report a generic attestation about a pre-built docker artifact (you provide the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest generic 
    	--fingerprint yourDockerImageFingerprint 
    	--name yourAttestationName 

    ```
  </Accordion>

  <Accordion title="report a generic attestation about a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest generic 
    	--name yourAttestationName 

    ```
  </Accordion>

  <Accordion title="report a generic attestation about an artifact which has not been reported yet in a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest generic 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--commit yourArtifactGitCommit 

    ```
  </Accordion>

  <Accordion title="report a generic attestation about a trail with an attachment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest generic 
    	--name yourAttestationName 
    	--attachments yourAttachmentPathName 

    ```
  </Accordion>

  <Accordion title="report a non-compliant generic attestation about a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest generic 
    	--name yourAttestationName 
    	--compliant=false 
    ```
  </Accordion>
</AccordionGroup>


# kosli attest jira
Source: https://docs.kosli.com/client_reference/kosli_attest_jira

Report a jira attestation to an artifact or a trail in a Kosli flow.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest jira [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Report a jira attestation to an artifact or a trail in a Kosli flow.\
Parses the given commit's message, current branch name or the content of the `--jira-secondary-source`
argument for Jira issue references of the form:
'at least 2 characters long, starting with an uppercase letter project key followed by
dash and one or more digits'.

Matching is case-insensitive: `proj-42` and `PROJ-42` in a commit message are both
recognised and returned as `PROJ-42`. Any token that matches the Jira key format
(a word boundary, two or more letters/digits starting with a letter, a dash, and one
or more digits) is treated as a candidate, regardless of whether it is an intentional
Jira reference. For example, a commit message `see note-1 for context, fixes PROJ-42`
will look up both `NOTE-1` and `PROJ-42` in Jira. If `NOTE-1` does not exist, the
attestation will be non-compliant even though `PROJ-42` is valid.
Use `--jira-project-key` to restrict matching to one or more known project keys and
avoid unintended candidates.

Any candidate match is automatically excluded if every occurrence in the parsed text is
immediately followed by a hyphen and a digit — for example, `CVE-2026-41284` is excluded
because `CVE-2026` would be followed by `-4`. This applies across all parsed sources
(commit message, branch name, and secondary source).
Note: if your Jira project key collides with this pattern (e.g. a project key of `CVE`), an
issue reference that happens to be the prefix of a longer hyphenated number (such as a CVE
identifier) will be filtered out. Use `--jira-secondary-source` with a different identifier
format as a workaround.

If you want to restrict the Jira issue matching to a specific project, use the
`--jira-project-key` flag to specify your own project key. You can specify multiple project keys if needed.

If the `--ignore-branch-match` is set, the branch name is not parsed for a match.

The found issue references will be checked against Jira to confirm their existence.
The attestation is reported in all cases, and its compliance status depends on referencing
existing Jira issues.

A reachable but wrong base URL still surfaces as a non-existent issue, because Jira answers 404
both for an issue that does not exist and for one you may not view. A base URL that cannot be
reached is reported as not confirmed, with the transport error as the reason. A credential
rejection is likewise detected and reported as not confirmed, with a warning identifying the
credentials. Use `--debug` to see the status Jira returned per issue.

The `--jira-issue-fields` can be used to include fields from the jira issue. By default no fields
are included. `*all` will give all fields. Using `--jira-issue-fields "*all" --dry-run` will give you
the complete list so you can select the once you need. The issue fields uses the jira API that is documented here:
[https://developer.atlassian.com/cloud/jira/platform/rest/v2/api-group-issues/#api-rest-api-2-issue-issueidorkey-get-request](https://developer.atlassian.com/cloud/jira/platform/rest/v2/api-group-issues/#api-rest-api-2-issue-issueidorkey-get-request)

The attestation can be bound to a *trail* using the trail name.
The attestation can be bound to an *artifact* in two ways:

* using the artifact's SHA256 fingerprint which is calculated (based on the `--artifact-type` flag and the artifact name/path argument) or can be provided directly (with the `--fingerprint` flag).
* using the artifact's name in the flow yaml template and the git commit from which the artifact is/will be created. Useful when reporting an attestation before creating/reporting the artifact.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
binding the attestation to the right artifact.
To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
In other CI systems, set them explicitly to capture repository metadata.

## Flags

| Flag                      | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :------------------------ | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--annotate`              | stringToString | \[optional] Annotate the attestation with data using key=value.                                                                                                                                                                                                                                                                                 |
| `-t`, `--artifact-type`   | string         | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).                                                                                                |
| `--assert`                | bool           | \[optional] Exit with non-zero code if the attestation is non-compliant                                                                                                                                                                                                                                                                         |
| `--attachments`           | strings        | \[optional] The comma-separated list of paths of attachments for the reported attestation. Attachments can be files or directories. All attachments are compressed and uploaded to Kosli's evidence vault.                                                                                                                                      |
| `-g`, `--commit`          | string         | \[conditional] The git commit for which the attestation is associated to. Becomes required when reporting an attestation for an artifact before reporting it to Kosli. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                   |
| `--description`           | string         | \[optional] attestation description                                                                                                                                                                                                                                                                                                             |
| `-D`, `--dry-run`         | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `-x`, `--exclude`         | strings        | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                                                                                                                |
| `--external-fingerprint`  | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`          | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `-F`, `--fingerprint`     | string         | \[conditional] The SHA256 fingerprint of the artifact to attach the attestation to. Only required if the attestation is for an artifact and `--artifact-type` and artifact name/path are not used.                                                                                                                                              |
| `-f`, `--flow`            | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `-h`, `--help`            | bool           | help for jira                                                                                                                                                                                                                                                                                                                                   |
| `--ignore-branch-match`   | bool           | Ignore branch name when searching for Jira ticket reference.                                                                                                                                                                                                                                                                                    |
| `--jira-api-token`        | string         | Jira API token (for Jira Cloud)                                                                                                                                                                                                                                                                                                                 |
| `--jira-base-url`         | string         | The base url for the jira project, e.g. `https://kosli.atlassian.net`                                                                                                                                                                                                                                                                           |
| `--jira-issue-fields`     | string         | \[optional] The comma separated list of fields to include from the Jira issue. Default no fields are included. '\*all' will give all fields.                                                                                                                                                                                                    |
| `--jira-pat`              | string         | Jira personal access token (for self-hosted Jira)                                                                                                                                                                                                                                                                                               |
| `--jira-project-key`      | strings        | \[optional] Jira project key to match against. Can be repeated, or given as a comma-separated list. Defaults to matching any jira project key.                                                                                                                                                                                                  |
| `--jira-secondary-source` | string         | \[optional] An optional string to search for Jira ticket reference, e.g. '`--jira-secondary-source` \$\{\{ github.head\_ref }}'                                                                                                                                                                                                                 |
| `--jira-username`         | string         | Jira username (for Jira Cloud)                                                                                                                                                                                                                                                                                                                  |
| `-n`, `--name`            | string         | The name of the attestation as declared in the flow or trail yaml template.                                                                                                                                                                                                                                                                     |
| `-o`, `--origin-url`      | string         | \[optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).                                                                                                                                            |
| `--redact-commit-info`    | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--registry-password`     | string         | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                          |
| `--registry-provider`     | string         | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                                                                                                                     |
| `--registry-username`     | string         | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                                          |
| `--repo-id`               | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`         | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`             | string         | \[defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")                                                                                                                   |
| `--repo-url`              | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`            | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `-T`, `--trail`           | string         | The Kosli trail name.                                                                                                                                                                                                                                                                                                                           |
| `-u`, `--user-data`       | string         | \[optional] The path to a JSON file containing additional data you would like to attach to the attestation.                                                                                                                                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report a jira attestation about a pre-built docker artifact (kosli calculates the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest jira yourDockerImageName 
    	--artifact-type docker 
    	--name yourAttestationName 
    	--jira-base-url https://kosli.atlassian.net 
    	--jira-username user@domain.com 
    	--jira-api-token yourJiraAPIToken 

    ```
  </Accordion>

  <Accordion title="report a jira attestation about a pre-built docker artifact (you provide the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest jira 
    	--fingerprint yourDockerImageFingerprint 
    	--name yourAttestationName 
    	--jira-base-url https://kosli.atlassian.net 
    	--jira-username user@domain.com 
    	--jira-api-token yourJiraAPIToken 

    ```
  </Accordion>

  <Accordion title="report a jira attestation about a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest jira 
    	--name yourAttestationName 
    	--jira-base-url https://kosli.atlassian.net 
    	--jira-username user@domain.com 
    	--jira-api-token yourJiraAPIToken 

    ```
  </Accordion>

  <Accordion title="report a jira attestation matching a specific jira project key">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest jira 
    	--name yourAttestationName 
    	--jira-base-url https://kosli.atlassian.net 
    	--jira-username user@domain.com 
    	--jira-api-token yourJiraAPIToken 
    	--jira-project-key ABC 

    ```
  </Accordion>

  <Accordion title="report a jira attestation about a trail and include jira issue summary, description and creator">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest jira 
    	--name yourAttestationName 
    	--jira-base-url https://kosli.atlassian.net 
    	--jira-username user@domain.com 
    	--jira-api-token yourJiraAPIToken 
    	--jira-issue-fields "summary,description,creator"

    ```
  </Accordion>

  <Accordion title="report a jira attestation about an artifact which has not been reported yet in a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest jira 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--commit yourArtifactGitCommit 
    	--jira-base-url https://kosli.atlassian.net 
    	--jira-username user@domain.com 
    	--jira-api-token yourJiraAPIToken 

    ```
  </Accordion>

  <Accordion title="report a jira attestation about a trail with an attachment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest jira 
    	--name yourAttestationName 
    	--jira-base-url https://kosli.atlassian.net 
    	--jira-username user@domain.com 
    	--jira-api-token yourJiraAPIToken 
    	--attachments yourAttachmentPathName 

    ```
  </Accordion>

  <Accordion title="fail if no issue reference is found, or the issue is not found in your jira instance">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest jira 
    	--name yourAttestationName 
    	--jira-base-url https://kosli.atlassian.net 
    	--jira-username user@domain.com 
    	--jira-api-token yourJiraAPIToken 
    	--assert

    ```
  </Accordion>

  <Accordion title="get jira reference from original branch name in a GitHub Pull Request merge job">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest jira 
    	--name yourAttestationName 
    	--jira-secondary-source ${{ github.head_ref }} 
    	--jira-base-url https://kosli.atlassian.net 
    	--jira-username user@domain.com 
    	--jira-api-token yourJiraAPIToken 
    ```
  </Accordion>
</AccordionGroup>


# kosli attest junit
Source: https://docs.kosli.com/client_reference/kosli_attest_junit

Report a junit attestation to an artifact or a trail in a Kosli flow. JUnit xml files are read from the `--results-dir` directory which defaults to the current directory. The xml files are automati...

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest junit [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Report a junit attestation to an artifact or a trail in a Kosli flow.
JUnit xml files are read from the `--results-dir` directory which defaults to the current directory.
The xml files are automatically uploaded as `--attachments` via the `--upload-results` flag which defaults to `true`.

The attestation can be bound to a *trail* using the trail name.
The attestation can be bound to an *artifact* in two ways:

* using the artifact's SHA256 fingerprint which is calculated (based on the `--artifact-type` flag and the artifact name/path argument) or can be provided directly (with the `--fingerprint` flag).
* using the artifact's name in the flow yaml template and the git commit from which the artifact is/will be created. Useful when reporting an attestation before creating/reporting the artifact.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
binding the attestation to the right artifact.
To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
In other CI systems, set them explicitly to capture repository metadata.

## Flags

| Flag                     | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :----------------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--annotate`             | stringToString | \[optional] Annotate the attestation with data using key=value.                                                                                                                                                                                                                                                                                 |
| `-t`, `--artifact-type`  | string         | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).                                                                                                |
| `--attachments`          | strings        | \[optional] The comma-separated list of paths of attachments for the reported attestation. Attachments can be files or directories. All attachments are compressed and uploaded to Kosli's evidence vault.                                                                                                                                      |
| `-g`, `--commit`         | string         | \[conditional] The git commit for which the attestation is associated to. Becomes required when reporting an attestation for an artifact before reporting it to Kosli. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                   |
| `--description`          | string         | \[optional] attestation description                                                                                                                                                                                                                                                                                                             |
| `-D`, `--dry-run`        | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `-x`, `--exclude`        | strings        | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                                                                                                                |
| `--external-fingerprint` | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`         | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `-F`, `--fingerprint`    | string         | \[conditional] The SHA256 fingerprint of the artifact to attach the attestation to. Only required if the attestation is for an artifact and `--artifact-type` and artifact name/path are not used.                                                                                                                                              |
| `-f`, `--flow`           | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `-h`, `--help`           | bool           | help for junit                                                                                                                                                                                                                                                                                                                                  |
| `-n`, `--name`           | string         | The name of the attestation as declared in the flow or trail yaml template.                                                                                                                                                                                                                                                                     |
| `-o`, `--origin-url`     | string         | \[optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).                                                                                                                                            |
| `--redact-commit-info`   | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--registry-password`    | string         | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                          |
| `--registry-provider`    | string         | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                                                                                                                     |
| `--registry-username`    | string         | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                                          |
| `--repo-id`              | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`        | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`            | string         | \[defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")                                                                                                                   |
| `--repo-url`             | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`           | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `-R`, `--results-dir`    | string         | \[defaulted] The path to a directory with JUnit test results. By default, the directory will be uploaded to Kosli's evidence vault. (default ".")                                                                                                                                                                                               |
| `-T`, `--trail`          | string         | The Kosli trail name.                                                                                                                                                                                                                                                                                                                           |
| `--upload-results`       | bool           | \[defaulted] Whether to upload the provided Junit results directory as an attachment to Kosli or not. (default true)                                                                                                                                                                                                                            |
| `-u`, `--user-data`      | string         | \[optional] The path to a JSON file containing additional data you would like to attach to the attestation.                                                                                                                                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli attest junit` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/differ/blob/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de/.github/workflows/main.yml#L101), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de?attestation_id=1143f5cc-9e0e-4bbc-a6bd-be16b348).
  </Tab>

  <Tab title="GitLab">
    View an example of the `kosli attest junit` command in GitLab.

    In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L126), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/d64d2b11879179255f11dc991e81fbaf4a040264?attestation_id=bea54670-c4f5-4e14-93b1-e234c111).
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report a junit attestation about a pre-built docker artifact (kosli calculates the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest junit yourDockerImageName 
    	--artifact-type docker 
    	--name yourAttestationName 
    	--results-dir yourFolderWithJUnitResults 

    ```
  </Accordion>

  <Accordion title="report a junit attestation about a pre-built docker artifact (you provide the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest junit 
    	--fingerprint yourDockerImageFingerprint 
    	--name yourAttestationName 
    	--results-dir yourFolderWithJUnitResults 

    ```
  </Accordion>

  <Accordion title="report a junit attestation about a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest junit 
    	--name yourAttestationName 
    	--results-dir yourFolderWithJUnitResults 

    ```
  </Accordion>

  <Accordion title="report a junit attestation about an artifact which has not been reported yet in a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest junit 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--commit yourArtifactGitCommit 
    	--results-dir yourFolderWithJUnitResults 

    ```
  </Accordion>

  <Accordion title="report a junit attestation about a trail with an attachment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest junit 
    	--name yourAttestationName 
    	--results-dir yourFolderWithJUnitResults 
    	--attachments yourAttachmentPathName 
    ```
  </Accordion>
</AccordionGroup>


# kosli attest pullrequest azure
Source: https://docs.kosli.com/client_reference/kosli_attest_pullrequest_azure

Report an Azure Devops pull request attestation to an artifact or a trail in a Kosli flow.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest pullrequest azure [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Report an Azure Devops pull request attestation to an artifact or a trail in a Kosli flow.\
It checks if a pull request exists for the artifact (based on its git commit) and reports the pull-request attestation to the artifact in Kosli.

The attestation can be bound to a *trail* using the trail name.
The attestation can be bound to an *artifact* in two ways:

* using the artifact's SHA256 fingerprint which is calculated (based on the `--artifact-type` flag and the artifact name/path argument) or can be provided directly (with the `--fingerprint` flag).
* using the artifact's name in the flow yaml template and the git commit from which the artifact is/will be created. Useful when reporting an attestation before creating/reporting the artifact.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

## Flags

| Flag                     | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :----------------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--annotate`             | stringToString | \[optional] Annotate the attestation with data using key=value.                                                                                                                                                                                                                                                                                 |
| `-t`, `--artifact-type`  | string         | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).                                                                                                |
| `--assert`               | bool           | \[optional] Exit with non-zero code if no pull requests found for the given commit.                                                                                                                                                                                                                                                             |
| `--attachments`          | strings        | \[optional] The comma-separated list of paths of attachments for the reported attestation. Attachments can be files or directories. All attachments are compressed and uploaded to Kosli's evidence vault.                                                                                                                                      |
| `--azure-org-url`        | string         | Azure organization url. E.g. `https://dev.azure.com/myOrg` (defaulted if you are running in Azure Devops pipelines: [docs](/integrations/ci_cd) ).                                                                                                                                                                                              |
| `--azure-token`          | string         | Azure Personal Access token.                                                                                                                                                                                                                                                                                                                    |
| `-g`, `--commit`         | string         | \[conditional] The git commit for which the attestation is associated to. Becomes required when reporting an attestation for an artifact before reporting it to Kosli. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                   |
| `--description`          | string         | \[optional] attestation description                                                                                                                                                                                                                                                                                                             |
| `-D`, `--dry-run`        | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `-x`, `--exclude`        | strings        | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                                                                                                                |
| `--external-fingerprint` | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`         | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `-F`, `--fingerprint`    | string         | \[conditional] The SHA256 fingerprint of the artifact to attach the attestation to. Only required if the attestation is for an artifact and `--artifact-type` and artifact name/path are not used.                                                                                                                                              |
| `-f`, `--flow`           | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `-h`, `--help`           | bool           | help for azure                                                                                                                                                                                                                                                                                                                                  |
| `-n`, `--name`           | string         | The name of the attestation as declared in the flow or trail yaml template.                                                                                                                                                                                                                                                                     |
| `-o`, `--origin-url`     | string         | \[optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).                                                                                                                                            |
| `--project`              | string         | Azure project.(defaulted if you are running in Azure Devops pipelines: [docs](/integrations/ci_cd) ).                                                                                                                                                                                                                                           |
| `--redact-commit-info`   | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--registry-password`    | string         | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                          |
| `--registry-provider`    | string         | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                                                                                                                     |
| `--registry-username`    | string         | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                                          |
| `--repo-id`              | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`        | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`            | string         | \[defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")                                                                                                                   |
| `--repo-url`             | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`           | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `-T`, `--trail`          | string         | The Kosli trail name.                                                                                                                                                                                                                                                                                                                           |
| `-u`, `--user-data`      | string         | \[optional] The path to a JSON file containing additional data you would like to attach to the attestation.                                                                                                                                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report an Azure Devops pull request attestation about a pre-built docker artifact (kosli calculates the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest azure yourDockerImageName 
    	--artifact-type docker 
    	--name yourAttestationName 
    	--azure-org-url https://dev.azure.com/myOrg 
    	--project yourAzureDevOpsProject 
    	--azure-token yourAzureToken 
    	--commit yourGitCommitSha1 
    	--repository yourAzureGitRepository 

    ```
  </Accordion>

  <Accordion title="report an Azure Devops pull request attestation about a pre-built docker artifact (you provide the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest azure 
    	--fingerprint yourDockerImageFingerprint 
    	--name yourAttestationName 
    	--azure-org-url https://dev.azure.com/myOrg 
    	--project yourAzureDevOpsProject 
    	--azure-token yourAzureToken 
    	--commit yourGitCommitSha1 
    	--repository yourAzureGitRepository 

    ```
  </Accordion>

  <Accordion title="report an Azure Devops pull request attestation about a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest azure 
    	--name yourAttestationName 
    	--azure-org-url https://dev.azure.com/myOrg 
    	--project yourAzureDevOpsProject 
    	--azure-token yourAzureToken 
    	--commit yourGitCommitSha1 
    	--repository yourAzureGitRepository 

    ```
  </Accordion>

  <Accordion title="report an Azure Devops pull request attestation about an artifact which has not been reported yet in a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest azure 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--azure-org-url https://dev.azure.com/myOrg 
    	--project yourAzureDevOpsProject 
    	--azure-token yourAzureToken 
    	--commit yourGitCommitSha1 
    	--repository yourAzureGitRepository 

    ```
  </Accordion>

  <Accordion title="report an Azure Devops pull request attestation about a trail with an attachment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest azure 
    	--name yourAttestationName 
    	--azure-org-url https://dev.azure.com/myOrg 
    	--project yourAzureDevOpsProject 
    	--azure-token yourAzureToken 
    	--commit yourGitCommitSha1 
    	--repository yourAzureGitRepository 
    	--attachments=yourAttachmentPathName 

    ```
  </Accordion>

  <Accordion title="fail if a pull request does not exist for your artifact">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest azure 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--azure-org-url https://dev.azure.com/myOrg 
    	--project yourAzureDevOpsProject 
    	--azure-token yourAzureToken 
    	--commit yourGitCommitSha1 
    	--repository yourAzureGitRepository 
    	--assert
    ```
  </Accordion>
</AccordionGroup>


# kosli attest pullrequest bitbucket
Source: https://docs.kosli.com/client_reference/kosli_attest_pullrequest_bitbucket

Report a Bitbucket pull request attestation to an artifact or a trail in a Kosli flow.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest pullrequest bitbucket [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Report a Bitbucket pull request attestation to an artifact or a trail in a Kosli flow.\
It checks if a pull request exists for a given merge commit and reports the pull-request attestation to Kosli.
Authentication to Bitbucket can be done with an access token (recommended) or an Atlassian API token, passed via --bitbucket-username (your Atlassian account email) and --bitbucket-password.
Bitbucket app passwords are no longer supported as of 28 July 2026; replace any app passwords with API tokens. Credentials need to have read access for both repos and pull requests.

The attestation can be bound to a *trail* using the trail name.
The attestation can be bound to an *artifact* in two ways:

* using the artifact's SHA256 fingerprint which is calculated (based on the `--artifact-type` flag and the artifact name/path argument) or can be provided directly (with the `--fingerprint` flag).
* using the artifact's name in the flow yaml template and the git commit from which the artifact is/will be created. Useful when reporting an attestation before creating/reporting the artifact.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

## Flags

| Flag                       | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :------------------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--annotate`               | stringToString | \[optional] Annotate the attestation with data using key=value.                                                                                                                                                                                                                                                                                 |
| `-t`, `--artifact-type`    | string         | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).                                                                                                |
| `--assert`                 | bool           | \[optional] Exit with non-zero code if no pull requests found for the given commit.                                                                                                                                                                                                                                                             |
| `--attachments`            | strings        | \[optional] The comma-separated list of paths of attachments for the reported attestation. Attachments can be files or directories. All attachments are compressed and uploaded to Kosli's evidence vault.                                                                                                                                      |
| `--bitbucket-access-token` | string         | Bitbucket repo/project/workspace access token. See [Bitbucket access tokens](https://developer.atlassian.com/cloud/bitbucket/rest/intro/#access-tokens) for more details.                                                                                                                                                                       |
| `--bitbucket-password`     | string         | Bitbucket API token. Bitbucket app passwords are no longer supported as of 28 July 2026. See [Bitbucket authentication](https://developer.atlassian.com/cloud/bitbucket/rest/intro/#authentication) for more details.                                                                                                                           |
| `--bitbucket-username`     | string         | Bitbucket username (your Atlassian account email when using an API token). Only needed if you use `--bitbucket-password`                                                                                                                                                                                                                        |
| `--bitbucket-workspace`    | string         | Bitbucket workspace ID.                                                                                                                                                                                                                                                                                                                         |
| `-g`, `--commit`           | string         | the git merge commit to be checked for associated pull requests.                                                                                                                                                                                                                                                                                |
| `--description`            | string         | \[optional] attestation description                                                                                                                                                                                                                                                                                                             |
| `-D`, `--dry-run`          | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `-x`, `--exclude`          | strings        | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                                                                                                                |
| `--external-fingerprint`   | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`           | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `-F`, `--fingerprint`      | string         | \[conditional] The SHA256 fingerprint of the artifact to attach the attestation to. Only required if the attestation is for an artifact and `--artifact-type` and artifact name/path are not used.                                                                                                                                              |
| `-f`, `--flow`             | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `-h`, `--help`             | bool           | help for bitbucket                                                                                                                                                                                                                                                                                                                              |
| `-n`, `--name`             | string         | The name of the attestation as declared in the flow or trail yaml template.                                                                                                                                                                                                                                                                     |
| `-o`, `--origin-url`       | string         | \[optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).                                                                                                                                            |
| `--redact-commit-info`     | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--registry-password`      | string         | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                          |
| `--registry-provider`      | string         | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                                                                                                                     |
| `--registry-username`      | string         | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                                          |
| `--repo-id`                | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`          | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`              | string         | \[defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")                                                                                                                   |
| `--repo-url`               | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`             | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `-T`, `--trail`            | string         | The Kosli trail name.                                                                                                                                                                                                                                                                                                                           |
| `-u`, `--user-data`        | string         | \[optional] The path to a JSON file containing additional data you would like to attach to the attestation.                                                                                                                                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report a Bitbucket pull request attestation about a pre-built docker artifact (kosli calculates the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest bitbucket yourDockerImageName 
    	--artifact-type docker 
    	--name yourAttestationName 
    	--bitbucket-access-token yourBitbucketAccessToken 
    	--bitbucket-workspace yourBitbucketWorkspace 
    	--commit yourArtifactGitCommit 
    	--repository yourBitbucketGitRepository 

    ```
  </Accordion>

  <Accordion title="report a Bitbucket pull request attestation about a pre-built docker artifact (you provide the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest bitbucket 
    	--fingerprint yourDockerImageFingerprint 
    	--name yourAttestationName 
    	--bitbucket-access-token yourBitbucketAccessToken 
    	--bitbucket-workspace yourBitbucketWorkspace 
    	--commit yourArtifactGitCommit 
    	--repository yourBitbucketGitRepository 

    ```
  </Accordion>

  <Accordion title="report a Bitbucket pull request attestation about a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest bitbucket 
    	--name yourAttestationName 
    	--bitbucket-access-token yourBitbucketAccessToken 
    	--bitbucket-workspace yourBitbucketWorkspace 
    	--commit yourArtifactGitCommit 
    	--repository yourBitbucketGitRepository 

    ```
  </Accordion>

  <Accordion title="report a Bitbucket pull request attestation about an artifact which has not been reported yet in a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest bitbucket 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--bitbucket-access-token yourBitbucketAccessToken 
    	--bitbucket-workspace yourBitbucketWorkspace 
    	--commit yourArtifactGitCommit 
    	--repository yourBitbucketGitRepository 

    ```
  </Accordion>

  <Accordion title="report a Bitbucket pull request attestation about a trail with an attachment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest bitbucket 
    	--name yourAttestationName 
    	--bitbucket-access-token yourBitbucketAccessToken 
    	--bitbucket-workspace yourBitbucketWorkspace 
    	--commit yourArtifactGitCommit 
    	--repository yourBitbucketGitRepository 
    	--attachments=yourAttachmentPathName 

    ```
  </Accordion>

  <Accordion title="fail if a pull request does not exist for your artifact">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest bitbucket 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--bitbucket-access-token yourBitbucketAccessToken 
    	--bitbucket-workspace yourBitbucketWorkspace 
    	--commit yourArtifactGitCommit 
    	--repository yourBitbucketGitRepository 
    	--assert
    ```
  </Accordion>
</AccordionGroup>


# kosli attest pullrequest github
Source: https://docs.kosli.com/client_reference/kosli_attest_pullrequest_github

Report a Github pull request attestation to an artifact or a trail in a Kosli flow.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest pullrequest github [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Report a Github pull request attestation to an artifact or a trail in a Kosli flow.\
It checks if a pull request exists for a given merge commit and reports the pull-request attestation to Kosli.

The attestation can be bound to a *trail* using the trail name.
The attestation can be bound to an *artifact* in two ways:

* using the artifact's SHA256 fingerprint which is calculated (based on the `--artifact-type` flag and the artifact name/path argument) or can be provided directly (with the `--fingerprint` flag).
* using the artifact's name in the flow yaml template and the git commit from which the artifact is/will be created. Useful when reporting an attestation before creating/reporting the artifact.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

## Flags

| Flag                     | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :----------------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--annotate`             | stringToString | \[optional] Annotate the attestation with data using key=value.                                                                                                                                                                                                                                                                                 |
| `-t`, `--artifact-type`  | string         | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).                                                                                                |
| `--assert`               | bool           | \[optional] Exit with non-zero code if no pull requests found for the given commit.                                                                                                                                                                                                                                                             |
| `--attachments`          | strings        | \[optional] The comma-separated list of paths of attachments for the reported attestation. Attachments can be files or directories. All attachments are compressed and uploaded to Kosli's evidence vault.                                                                                                                                      |
| `-g`, `--commit`         | string         | the git merge commit to be checked for associated pull requests.                                                                                                                                                                                                                                                                                |
| `--description`          | string         | \[optional] attestation description                                                                                                                                                                                                                                                                                                             |
| `-D`, `--dry-run`        | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `-x`, `--exclude`        | strings        | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                                                                                                                |
| `--external-fingerprint` | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`         | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `-F`, `--fingerprint`    | string         | \[conditional] The SHA256 fingerprint of the artifact to attach the attestation to. Only required if the attestation is for an artifact and `--artifact-type` and artifact name/path are not used.                                                                                                                                              |
| `-f`, `--flow`           | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `--github-base-url`      | string         | \[optional] GitHub base URL (only needed for GitHub Enterprise installations).                                                                                                                                                                                                                                                                  |
| `--github-org`           | string         | Github organization. (defaulted if you are running in GitHub Actions: [docs](/integrations/ci_cd) ).                                                                                                                                                                                                                                            |
| `--github-token`         | string         | Github token.                                                                                                                                                                                                                                                                                                                                   |
| `-h`, `--help`           | bool           | help for github                                                                                                                                                                                                                                                                                                                                 |
| `-n`, `--name`           | string         | The name of the attestation as declared in the flow or trail yaml template.                                                                                                                                                                                                                                                                     |
| `-o`, `--origin-url`     | string         | \[optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).                                                                                                                                            |
| `--redact-commit-info`   | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--registry-password`    | string         | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                          |
| `--registry-provider`    | string         | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                                                                                                                     |
| `--registry-username`    | string         | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                                          |
| `--repo-id`              | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`        | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`            | string         | \[defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")                                                                                                                   |
| `--repo-url`             | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`           | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `-T`, `--trail`          | string         | The Kosli trail name.                                                                                                                                                                                                                                                                                                                           |
| `-u`, `--user-data`      | string         | \[optional] The path to a JSON file containing additional data you would like to attach to the attestation.                                                                                                                                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli attest pullrequest github` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/differ/blob/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de/.github/workflows/main.yml#L81), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de?attestation_id=7cf44301-0ca2-4b1f-9ce2-6f17ee0d).
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report a Github pull request attestation about a pre-built docker artifact (kosli calculates the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest github yourDockerImageName 
    	--artifact-type docker 
    	--name yourAttestationName 
    	--github-token yourGithubToken 
    	--github-org yourGithubOrg 
    	--commit yourArtifactGitCommit 
    	--repository yourGithubGitRepository 

    ```
  </Accordion>

  <Accordion title="report a Github pull request attestation about a pre-built docker artifact (you provide the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest github 
    	--fingerprint yourDockerImageFingerprint 
    	--name yourAttestationName 
    	--github-token yourGithubToken 
    	--github-org yourGithubOrg 
    	--commit yourArtifactGitCommit 
    	--repository yourGithubGitRepository 

    ```
  </Accordion>

  <Accordion title="report a Github pull request attestation about a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest github 
    	--name yourAttestationName 
    	--github-token yourGithubToken 
    	--github-org yourGithubOrg 
    	--commit yourArtifactGitCommit 
    	--repository yourGithubGitRepository 

    ```
  </Accordion>

  <Accordion title="report a Github pull request attestation about an artifact which has not been reported yet in a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest github 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--github-token yourGithubToken 
    	--github-org yourGithubOrg 
    	--commit yourArtifactGitCommit 
    	--repository yourGithubGitRepository 

    ```
  </Accordion>

  <Accordion title="report a Github pull request attestation about a trail with an attachment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest github 
    	--name yourAttestationName 
    	--github-token yourGithubToken 
    	--github-org yourGithubOrg 
    	--commit yourArtifactGitCommit 
    	--repository yourGithubGitRepository 
    	--attachments=yourAttachmentPathName 

    ```
  </Accordion>

  <Accordion title="fail if a pull request does not exist for your artifact">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest github 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--github-token yourGithubToken 
    	--github-org yourGithubOrg 
    	--commit yourArtifactGitCommit 
    	--repository yourGithubGitRepository 
    	--assert
    ```
  </Accordion>
</AccordionGroup>


# kosli attest pullrequest gitlab
Source: https://docs.kosli.com/client_reference/kosli_attest_pullrequest_gitlab

Report a Gitlab merge request attestation to an artifact or a trail in a Kosli flow.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest pullrequest gitlab [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Report a Gitlab merge request attestation to an artifact or a trail in a Kosli flow.\
It checks if a merge request exists for a given merge commit and reports the merge request attestation to Kosli.

The attestation can be bound to a *trail* using the trail name.
The attestation can be bound to an *artifact* in two ways:

* using the artifact's SHA256 fingerprint which is calculated (based on the `--artifact-type` flag and the artifact name/path argument) or can be provided directly (with the `--fingerprint` flag).
* using the artifact's name in the flow yaml template and the git commit from which the artifact is/will be created. Useful when reporting an attestation before creating/reporting the artifact.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

## Flags

| Flag                     | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :----------------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--annotate`             | stringToString | \[optional] Annotate the attestation with data using key=value.                                                                                                                                                                                                                                                                                 |
| `-t`, `--artifact-type`  | string         | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).                                                                                                |
| `--assert`               | bool           | \[optional] Exit with non-zero code if no pull requests found for the given commit.                                                                                                                                                                                                                                                             |
| `--attachments`          | strings        | \[optional] The comma-separated list of paths of attachments for the reported attestation. Attachments can be files or directories. All attachments are compressed and uploaded to Kosli's evidence vault.                                                                                                                                      |
| `-g`, `--commit`         | string         | the git merge commit to be checked for associated pull requests.                                                                                                                                                                                                                                                                                |
| `--description`          | string         | \[optional] attestation description                                                                                                                                                                                                                                                                                                             |
| `-D`, `--dry-run`        | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `-x`, `--exclude`        | strings        | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                                                                                                                |
| `--external-fingerprint` | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`         | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `-F`, `--fingerprint`    | string         | \[conditional] The SHA256 fingerprint of the artifact to attach the attestation to. Only required if the attestation is for an artifact and `--artifact-type` and artifact name/path are not used.                                                                                                                                              |
| `-f`, `--flow`           | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `--gitlab-base-url`      | string         | \[optional] Gitlab base URL (only needed for on-prem Gitlab installations).                                                                                                                                                                                                                                                                     |
| `--gitlab-org`           | string         | Gitlab organization. (defaulted if you are running in Gitlab Pipelines: [docs](/integrations/ci_cd) ).                                                                                                                                                                                                                                          |
| `--gitlab-token`         | string         | Gitlab token.                                                                                                                                                                                                                                                                                                                                   |
| `-h`, `--help`           | bool           | help for gitlab                                                                                                                                                                                                                                                                                                                                 |
| `-n`, `--name`           | string         | The name of the attestation as declared in the flow or trail yaml template.                                                                                                                                                                                                                                                                     |
| `-o`, `--origin-url`     | string         | \[optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).                                                                                                                                            |
| `--redact-commit-info`   | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--registry-password`    | string         | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                          |
| `--registry-provider`    | string         | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                                                                                                                     |
| `--registry-username`    | string         | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                                          |
| `--repo-id`              | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`        | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`            | string         | \[defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")                                                                                                                   |
| `--repo-url`             | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`           | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `-T`, `--trail`          | string         | The Kosli trail name.                                                                                                                                                                                                                                                                                                                           |
| `-u`, `--user-data`      | string         | \[optional] The path to a JSON file containing additional data you would like to attach to the attestation.                                                                                                                                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitLab">
    View an example of the `kosli attest pullrequest gitlab` command in GitLab.

    In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L75), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/d64d2b11879179255f11dc991e81fbaf4a040264?attestation_id=c02a9fb9-70fd-44e8-80f0-ec85ea83).
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report a Gitlab merge request attestation about a pre-built docker artifact (kosli calculates the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest gitlab yourDockerImageName 
    	--artifact-type docker 
    	--name yourAttestationName 
    	--gitlab-token yourGitlabToken 
    	--gitlab-org yourGitlabOrg 
    	--commit yourArtifactGitCommit 
    	--repository yourGithubGitRepository 

    ```
  </Accordion>

  <Accordion title="report a Gitlab merge request attestation about a pre-built docker artifact (you provide the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest gitlab 
    	--fingerprint yourDockerImageFingerprint 
    	--name yourAttestationName 
    	--gitlab-token yourGitlabToken 
    	--gitlab-org yourGitlabOrg 
    	--commit yourArtifactGitCommit 
    	--repository yourGithubGitRepository 

    ```
  </Accordion>

  <Accordion title="report a Gitlab merge request attestation about a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest gitlab 
    	--name yourAttestationName 
    	--gitlab-token yourGitlabToken 
    	--gitlab-org yourGitlabOrg 
    	--commit yourArtifactGitCommit 
    	--repository yourGithubGitRepository 

    ```
  </Accordion>

  <Accordion title="report a Gitlab merge request attestation about an artifact which has not been reported yet in a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest gitlab 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--gitlab-token yourGitlabToken 
    	--gitlab-org yourGitlabOrg 
    	--commit yourArtifactGitCommit 
    	--repository yourGithubGitRepository 

    ```
  </Accordion>

  <Accordion title="report a Gitlab merge request attestation about a trail with an attachment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest gitlab 
    	--name yourAttestationName 
    	--gitlab-token yourGitlabToken 
    	--gitlab-org yourGitlabOrg 
    	--commit yourArtifactGitCommit 
    	--repository yourGithubGitRepository 
    	--attachments=yourAttachmentPathName 

    ```
  </Accordion>

  <Accordion title="fail if a merge request does not exist for your artifact">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest pullrequest gitlab 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--gitlab-token yourGitlabToken 
    	--gitlab-org yourGitlabOrg 
    	--commit yourArtifactGitCommit 
    	--repository yourGithubGitRepository 
    	--assert
    ```
  </Accordion>
</AccordionGroup>


# kosli attest snyk
Source: https://docs.kosli.com/client_reference/kosli_attest_snyk

Report a snyk attestation to an artifact or a trail in a Kosli flow.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest snyk [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Report a snyk attestation to an artifact or a trail in a Kosli flow.\
Only SARIF snyk output is accepted.
Snyk output can be for "snyk code test", "snyk container test", or "snyk iac test".

The `--scan-results` .json file is analyzed and a summary of the scan results are reported to Kosli.

By default, the `--scan-results` .json file is also uploaded to Kosli's evidence vault.
You can disable that by setting `--upload-results=false`

The attestation can be bound to a *trail* using the trail name.
The attestation can be bound to an *artifact* in two ways:

* using the artifact's SHA256 fingerprint which is calculated (based on the `--artifact-type` flag and the artifact name/path argument) or can be provided directly (with the `--fingerprint` flag).
* using the artifact's name in the flow yaml template and the git commit from which the artifact is/will be created. Useful when reporting an attestation before creating/reporting the artifact.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
binding the attestation to the right artifact.
To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
In other CI systems, set them explicitly to capture repository metadata.

## Flags

| Flag                     | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :----------------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--annotate`             | stringToString | \[optional] Annotate the attestation with data using key=value.                                                                                                                                                                                                                                                                                 |
| `-t`, `--artifact-type`  | string         | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).                                                                                                |
| `--attachments`          | strings        | \[optional] The comma-separated list of paths of attachments for the reported attestation. Attachments can be files or directories. All attachments are compressed and uploaded to Kosli's evidence vault.                                                                                                                                      |
| `-g`, `--commit`         | string         | \[conditional] The git commit for which the attestation is associated to. Becomes required when reporting an attestation for an artifact before reporting it to Kosli. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                   |
| `--description`          | string         | \[optional] attestation description                                                                                                                                                                                                                                                                                                             |
| `-D`, `--dry-run`        | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `-x`, `--exclude`        | strings        | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                                                                                                                |
| `--external-fingerprint` | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`         | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `-F`, `--fingerprint`    | string         | \[conditional] The SHA256 fingerprint of the artifact to attach the attestation to. Only required if the attestation is for an artifact and `--artifact-type` and artifact name/path are not used.                                                                                                                                              |
| `-f`, `--flow`           | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `-h`, `--help`           | bool           | help for snyk                                                                                                                                                                                                                                                                                                                                   |
| `-n`, `--name`           | string         | The name of the attestation as declared in the flow or trail yaml template.                                                                                                                                                                                                                                                                     |
| `-o`, `--origin-url`     | string         | \[optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).                                                                                                                                            |
| `--redact-commit-info`   | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--registry-password`    | string         | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                          |
| `--registry-provider`    | string         | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                                                                                                                     |
| `--registry-username`    | string         | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                                          |
| `--repo-id`              | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`        | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`            | string         | \[defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")                                                                                                                   |
| `--repo-url`             | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`           | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `-R`, `--scan-results`   | string         | The path to Snyk scan SARIF results file from 'snyk test' and 'snyk container test'. By default, the Snyk results will be uploaded to Kosli's evidence vault.                                                                                                                                                                                   |
| `-T`, `--trail`          | string         | The Kosli trail name.                                                                                                                                                                                                                                                                                                                           |
| `--upload-results`       | bool           | \[defaulted] Whether to upload the provided Snyk results file as an attachment to Kosli or not. (default true)                                                                                                                                                                                                                                  |
| `-u`, `--user-data`      | string         | \[optional] The path to a JSON file containing additional data you would like to attach to the attestation.                                                                                                                                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli attest snyk` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/snyk-container-test/blob/43373102aa2abee72027e2aba050adea9fdb0173/action.yml#L70), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/2e482ef95263c81570a82f0456b026e29203d550?attestation_id=c4d17fb4-05d2-4894-bca7-f21e56ab).
  </Tab>

  <Tab title="GitLab">
    View an example of the `kosli attest snyk` command in GitLab.

    In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/a184b5b7d2053ce2b2f7064bf46f0b6f72f9f393/.gitlab/workflows/main.yml#L146), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/a184b5b7d2053ce2b2f7064bf46f0b6f72f9f393?attestation_id=3e9cd5ee-4fd3-403f-ba59-6d431dec).
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report a snyk attestation about a pre-built docker artifact (kosli calculates the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest snyk yourDockerImageName 
    	--artifact-type docker 
    	--name yourAttestationName 
    	--scan-results yourSnykSARIFScanResults 

    ```
  </Accordion>

  <Accordion title="report a snyk attestation about a pre-built docker artifact (you provide the fingerprint)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest snyk 
    	--fingerprint yourDockerImageFingerprint 
    	--name yourAttestationName 
    	--scan-results yourSnykSARIFScanResults 

    ```
  </Accordion>

  <Accordion title="report a snyk attestation about a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest snyk 
    	--name yourAttestationName 
    	--scan-results yourSnykSARIFScanResults 

    ```
  </Accordion>

  <Accordion title="report a snyk attestation about an artifact which has not been reported yet in a trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest snyk 
    	--name yourTemplateArtifactName.yourAttestationName 
    	--commit yourArtifactGitCommit 
    	--scan-results yourSnykSARIFScanResults 

    ```
  </Accordion>

  <Accordion title="report a snyk attestation about a trail with an attachment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest snyk 
    	--name yourAttestationName 
    	--scan-results yourSnykSARIFScanResults 
    	--attachments yourEvidencePathName 

    ```
  </Accordion>

  <Accordion title="report a snyk attestation about a trail without uploading the snyk results file">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest snyk 
    	--name yourAttestationName 
    	--scan-results yourSnykSARIFScanResults 
    	--upload-results=false 
    ```
  </Accordion>
</AccordionGroup>


# kosli attest sonar
Source: https://docs.kosli.com/client_reference/kosli_attest_sonar

Report a SonarQube attestation to an artifact or a trail in a Kosli flow.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest sonar [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags]
```

Report a SonarQube attestation to an artifact or a trail in a Kosli flow.\
Retrieves results for the specified scan from SonarQube Cloud or SonarQube Server and attests them to Kosli.
The results are parsed to find the status of the project's quality gate which is used to determine the attestation's compliance status.
Both branch scans and pull request scans are supported.

The scan to be retrieved can be specified in three ways:

1. (Default) Using metadata created by the Sonar scanner. By default this is located within a temporary `.scannerwork` folder in the repo base directory.
   If you have overridden the location of this folder by passing parameters to the Sonar scanner, or are running Kosli's CLI locally outside the repo's base directory,
   you can provide the correct path using the `--sonar-working-dir` flag. This metadata is generated by a specific scan, allowing Kosli to retrieve the results of that scan.
   If there are delays in the scan processing (either because the scanned project is very large, or because SonarQube is experiencing processing delays), it may happen that
   the scan results are not available by the time the attest sonar command is executed. In this case you can use the `--max-wait` flag to retry the command while waiting for the scan to be processed.
   This flag takes the maximum number of seconds to wait for the results to be available. The Kosli CLI will then attempt to retrieve the scan results until the maximum wait time is reached, with
   exponential backoff between retries. Once the results are available they are attested to Kosli as usual.

2. Providing the Sonar project key and either the revision or the pull-request ID of the scan (plus the SonarQube server URL if relevant).
   For branch scans: if running the Kosli CLI in some CI/CD pipeline, the revision is defaulted to the commit SHA. If you are running the command locally,
   or have overridden the revision in SonarQube via parameters to the Sonar scanner, you can provide the correct revision using the `--sonar-revision` flag.
   If the scan ran on a branch other than the project's main branch in SonarQube, also provide the branch name using the `--sonar-branch` flag.
   SonarQube only searches the project's main branch unless told otherwise, so without this flag the scan cannot be found.
   For pull request scans: provide the pull-request ID using the `--pull-request` flag instead of the revision.
   Kosli then finds the scan results for the specified project key and revision or pull-request ID.

3. Providing the CE task URL directly via `--sonar-ce-task-url`. The CE task URL can be found in the `report-task.txt` file
   generated by the Sonar scanner (the `ceTaskUrl` field). This is useful in CI/CD environments where the Sonar scanner and the Kosli CLI
   run in different containers that do not share a filesystem, making the `report-task.txt` file inaccessible to the CLI.

Note that if your project is very large and you are using SonarQube Cloud's automatic analysis, it is possible for the attest sonar command to run before the SonarQube Cloud scan is completed.
In this case, we recommend using Kosli's Sonar webhook integration ( [docs](/integrations/sonar/) ) rather than the CLI to attest the scan results.

The attestation can be bound to a *trail* using the trail name.
The attestation can be bound to an *artifact* in two ways:

* using the artifact's SHA256 fingerprint which is calculated (based on the `--artifact-type` flag and the artifact name/path argument) or can be provided directly (with the `--fingerprint` flag).
* using the artifact's name in the flow yaml template and the git commit from which the artifact is/will be created. Useful when reporting an attestation before creating/reporting the artifact.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

## Flags

| Flag                     | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :----------------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--annotate`             | stringToString | \[optional] Annotate the attestation with data using key=value.                                                                                                                                                                                                                                                                                 |
| `-t`, `--artifact-type`  | string         | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).                                                                                                |
| `--attachments`          | strings        | \[optional] The comma-separated list of paths of attachments for the reported attestation. Attachments can be files or directories. All attachments are compressed and uploaded to Kosli's evidence vault.                                                                                                                                      |
| `-g`, `--commit`         | string         | \[conditional] The git commit for which the attestation is associated to. Becomes required when reporting an attestation for an artifact before reporting it to Kosli. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                   |
| `--description`          | string         | \[optional] attestation description                                                                                                                                                                                                                                                                                                             |
| `-D`, `--dry-run`        | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `-x`, `--exclude`        | strings        | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                                                                                                                |
| `--external-fingerprint` | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`         | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `-F`, `--fingerprint`    | string         | \[conditional] The SHA256 fingerprint of the artifact to attach the attestation to. Only required if the attestation is for an artifact and `--artifact-type` and artifact name/path are not used.                                                                                                                                              |
| `-f`, `--flow`           | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `-h`, `--help`           | bool           | help for sonar                                                                                                                                                                                                                                                                                                                                  |
| `--max-wait`             | int            | \[optional] Allow the command to wait and retry fetching the scan results from SonarQube, up to the maximum number of seconds provided, with exponential backoff. Useful when using SonarQube's metadata file to retrieve and attest scans that take a long time to process . Defaults to 30 seconds. (default 30)                              |
| `-n`, `--name`           | string         | The name of the attestation as declared in the flow or trail yaml template.                                                                                                                                                                                                                                                                     |
| `-o`, `--origin-url`     | string         | \[optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).                                                                                                                                            |
| `--pull-request`         | string         | \[conditional] The ID of the pull-request. Only required if you want to use the project key/pull-request to get the scan results rather than using Sonar's metadata file. Cannot be used with `--sonar-revision` or `--sonar-branch`.                                                                                                           |
| `--redact-commit-info`   | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--registry-password`    | string         | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                          |
| `--registry-provider`    | string         | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                                                                                                                     |
| `--registry-username`    | string         | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                                                                                                          |
| `--repo-id`              | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`        | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`            | string         | \[defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")                                                                                                                   |
| `--repo-url`             | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`           | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `--sonar-api-token`      | string         | \[required] SonarQube API token.                                                                                                                                                                                                                                                                                                                |
| `--sonar-branch`         | string         | \[conditional] The name of the branch the SonarQube scan ran on. Only required if you are using the project key/revision to get the scan results and the scan ran on a branch other than the project's main branch in SonarQube. Cannot be used with `--pull-request`.                                                                          |
| `--sonar-ce-task-url`    | string         | \[conditional] The URL of the SonarQube CE task. Can be used instead of `--sonar-working-dir` when the report-task.txt file is not accessible, e.g. due to container isolation in CI/CD pipelines.                                                                                                                                              |
| `--sonar-project-key`    | string         | \[conditional] The project key of the SonarQube project. Only required if you want to use the project key/revision/pull-request to get the scan results rather than using Sonar's metadata file.                                                                                                                                                |
| `--sonar-revision`       | string         | \[conditional] The revision of the SonarQube project. Only required if you want to use the project key/revision to get the scan results rather than using Sonar's metadata file and you have overridden the default revision, or you aren't using a CI. Defaults to the value of the git commit flag. Cannot be used with `--pull-request`.     |
| `--sonar-server-url`     | string         | \[conditional] The URL of your SonarQube server. Only required if you are using SonarQube Server and not using SonarQube's metadata file to get scan results. (default "[https://sonarcloud.io](https://sonarcloud.io)")                                                                                                                        |
| `--sonar-working-dir`    | string         | \[conditional] The base directory of the repo scanned by SonarQube. Only required if you have overridden the default in the Sonar scanner or you are running the CLI locally in a separate folder from the repo. (default ".scannerwork")                                                                                                       |
| `-T`, `--trail`          | string         | The Kosli trail name.                                                                                                                                                                                                                                                                                                                           |
| `-u`, `--user-data`      | string         | \[optional] The path to a JSON file containing additional data you would like to attach to the attestation.                                                                                                                                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli attest sonar` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/dashboard/blob/ff9f292e809801d35246183988b7812826bc2760/.github/workflows/main.yml#L123), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/dashboard-ci/trails/ff9f292e809801d35246183988b7812826bc2760?attestation_id=6d693383-c6de-4551-8a29-1025803a).
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report a SonarQube Cloud attestation about a trail using SonarQube's metadata, with no retries">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest sonar 
    	--name yourAttestationName 
    	--sonar-api-token yourSonarAPIToken 
    	--sonar-working-dir yourSonarWorkingDirPath 

    ```
  </Accordion>

  <Accordion title="report a SonarQube Server attestation about a trail using SonarQube's metadata, waiting for up to 60 seconds for the results to be available">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest sonar 
    	--name yourAttestationName 
    	--sonar-api-token yourSonarAPIToken 
    	--sonar-working-dir yourSonarWorkingDirPath 
    	--max-wait 60

    ```
  </Accordion>

  <Accordion title="report a SonarQube Cloud attestation about a trail using key/revision">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest sonar 
    	--name yourAttestationName 
    	--sonar-api-token yourSonarAPIToken 
    	--sonar-project-key yourSonarProjectKey 
    	--sonar-revision yourSonarRevision 

    ```
  </Accordion>

  <Accordion title="report a SonarQube Server attestation about a trail using key/revision">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest sonar 
    	--name yourAttestationName 
    	--sonar-api-token yourSonarAPIToken 
    	--sonar-server-url yourSonarServerURL 
    	--sonar-project-key yourSonarProjectKey 
    	--sonar-revision yourSonarRevision 

    ```
  </Accordion>

  <Accordion title="report a SonarQube Cloud attestation about a trail using key/revision for a scan on a non-main branch">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest sonar 
    	--name yourAttestationName 
    	--sonar-api-token yourSonarAPIToken 
    	--sonar-project-key yourSonarProjectKey 
    	--sonar-revision yourSonarRevision 
    	--sonar-branch yourSonarBranchName 

    ```
  </Accordion>

  <Accordion title="report a SonarQube Cloud attestation about a trail for a pull request scan using key/pull-request">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest sonar 
    	--name yourAttestationName 
    	--sonar-api-token yourSonarAPIToken 
    	--sonar-project-key yourSonarProjectKey 
    	--pull-request yourPullRequestID 

    ```
  </Accordion>

  <Accordion title="report a SonarQube Cloud attestation about a trail with an attachment using SonarQube's metadata, waiting for up to 300 seconds for the results to be available">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest sonar 
    	--name yourAttestationName 
    	--sonar-api-token yourSonarAPIToken 
    	--sonar-working-dir yourSonarWorkingDirPath 
    	--attachment yourAttachmentPath 
    	--max-wait 300

    ```
  </Accordion>

  <Accordion title="report a SonarQube attestation using the CE task URL directly (useful when report-task.txt is not accessible)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest sonar 
    	--name yourAttestationName 
    	--sonar-api-token yourSonarAPIToken 
    	--sonar-ce-task-url yourCETaskURL 
    ```
  </Accordion>
</AccordionGroup>


# kosli begin trail
Source: https://docs.kosli.com/client_reference/kosli_begin_trail

Begin or update a Kosli flow trail.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli begin trail TRAIL-NAME [flags]
```

Begin or update a Kosli flow trail.

You can optionally associate the trail to a git commit using `--commit` (requires access to a git repo). And you
can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
In other CI systems, set them explicitly to capture repository metadata.

`TRAIL-NAME`s must start with a letter or number, and only contain letters, numbers, `.`, `-`, `_`, and `~`.

## Flags

| Flag                     | Type           | Description                                                                                                                                                                                                                                                                                                                                     |
| :----------------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-g`, `--commit`         | string         | \[defaulted] The git commit from which the trail is begun. (defaulted in some CIs: [docs](/integrations/ci_cd), otherwise defaults to HEAD ).                                                                                                                                                                                                   |
| `--description`          | string         | \[optional] The Kosli trail description.                                                                                                                                                                                                                                                                                                        |
| `-D`, `--dry-run`        | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                                            |
| `--external-fingerprint` | stringToString | \[optional] A SHA256 fingerprint of an external attachment represented by `--external-url`. The format is label=fingerprint (labels cannot contain '.' or '='). This flag can be set multiple times. There must be an external url with a matching label for each external fingerprint.                                                         |
| `--external-url`         | stringToString | \[optional] Add labeled reference URL for an external resource. The format is label=url (labels cannot contain '.' or '='). This flag can be set multiple times. If the resource is a file or dir, you can optionally add its fingerprint via `--external-fingerprint`                                                                          |
| `--flow`                 | string         | The Kosli flow name.                                                                                                                                                                                                                                                                                                                            |
| `-h`, `--help`           | bool           | help for trail                                                                                                                                                                                                                                                                                                                                  |
| `-o`, `--origin-url`     | string         | \[optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).                                                                                                                                            |
| `--redact-commit-info`   | strings        | \[optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of \[author, message, branch].                                                                                                                                                                                                       |
| `--repo-id`              | string         | \[conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
| `--repo-provider`        | string         | \[optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket\_cloud, bitbucket\_dc, azure-devops, azure\_devops\_services, azure\_devops\_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                          |
| `--repo-root`            | string         | \[defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")                                                                                                                   |
| `--repo-url`             | string         | \[conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                    |
| `--repository`           | string         | \[conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                 |
| `-f`, `--template-file`  | string         | \[optional] The path to a yaml template file.                                                                                                                                                                                                                                                                                                   |
| `-u`, `--user-data`      | string         | \[optional] The path to a JSON file containing additional data you would like to attach to the flow trail.                                                                                                                                                                                                                                      |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli begin trail` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/runner/blob/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9/.github/workflows/main.yml#L78), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/runner-ci/trails/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9?attestation_id=1).
  </Tab>

  <Tab title="GitLab">
    View an example of the `kosli begin trail` command in GitLab.

    In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L55), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/d64d2b11879179255f11dc991e81fbaf4a040264?attestation_id=1).
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="begin/update a Kosli flow trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli begin trail yourTrailName 
    	--description yourTrailDescription 
    	--template-file /path/to/your/template/file.yml 
    	--user-data /path/to/your/user-data/file.json 
    ```
  </Accordion>
</AccordionGroup>


# kosli completion
Source: https://docs.kosli.com/client_reference/kosli_completion

Generate completion script

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli completion [bash|zsh|fish|powershell]
```

To load completions:

### Bash

```
  $ source <(kosli completion bash)
```

To load completions for each session, execute once:

On Linux:

```
$ kosli completion bash > /etc/bash_completion.d/kosli
```

On macOS:

```
$ kosli completion bash > $(brew --prefix)/etc/bash_completion.d/kosli
```

### Zsh

If shell completion is not already enabled in your environment,\
you will need to enable it.  You can execute the following once:

```
$ echo "autoload -U compinit; compinit" >> ~/.zshrc
```

To load completions for each session, execute once:

```
$ kosli completion zsh > "${fpath[1]}/_kosli"
```

You will need to start a new shell for this setup to take effect.

### fish

```
$ kosli completion fish | source
```

To load completions for each session, execute once:

```
$ kosli completion fish > ~/.config/fish/completions/kosli.fish
```

### PowerShell

```
PS> kosli completion powershell | Out-String | Invoke-Expression
```

To load completions for every new session, run:

```
PS> kosli completion powershell > kosli.ps1
```

and source this file from your PowerShell profile.

## Flags

| Flag           | Type | Description         |
| :------------- | :--- | :------------------ |
| `-h`, `--help` | bool | help for completion |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |


# kosli config
Source: https://docs.kosli.com/client_reference/kosli_config

Config global Kosli flags values and store them in $HOME/.kosli .  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli config [flags]
```

Config global Kosli flags values and store them in \$HOME/.kosli .

Flag values are determined in the following order (highest precedence first):

* command line flags on each executed command.
* environment variables.
* custom config file provided with --config-file flag.
* default config file in \$HOME/.kosli

You can configure global Kosli flags (the ones that apply to all/most commands) using their dedicated
convenience flags (e.g. --org).

API tokens are stored in the suitable credentials manager on your machine.

Other Kosli flags can be configured using the --set flag which takes a comma-separated list of key=value pairs.
Keys correspond to the specific flag name, capitalized. For instance: --flow would be set using --set FLOW=value

## Flags

| Flag           | Type           | Description                                                                        |
| :------------- | :------------- | :--------------------------------------------------------------------------------- |
| `-h`, `--help` | bool           | help for config                                                                    |
| `--set`        | stringToString | \[optional] The key-value pairs to tag the resource with. The format is: key=value |
| `--unset`      | strings        | \[optional] The list of tag keys to remove from the resource.                      |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="configure global flags in your default config file">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli config --org=yourOrg 
    	--api-token=yourAPIToken 
    	--host=https://app.kosli.com 
    	--debug=false 
    	--max-api-retries=3 
    	--http-proxy=http://192.0.0.1:8080

    ```
  </Accordion>

  <Accordion title="configure non-global flags in your default config file">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli config --set FLOW=yourFlowName

    ```
  </Accordion>

  <Accordion title="remove a key from the default config file">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli config --unset FLOW
    ```
  </Accordion>
</AccordionGroup>


# kosli create api-key
Source: https://docs.kosli.com/client_reference/kosli_create_api-key

Create an API key for a service account.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create api-key [flags]
```

Create an API key for a service account.

The key value is only returned once, at creation time, so make sure to store it securely.

## Flags

| Flag                      | Type   | Description                                                                                                                                                          |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-d`, `--description`     | string | A description for the API key.                                                                                                                                       |
| `-D`, `--dry-run`         | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                 |
| `-e`, `--expires-at`      | string | \[optional] When the API key expires. Accepts an epoch timestamp or a date like '2026-06-04', '2026-06-04 15:04:05', or an RFC3339 timestamp. Defaults to no expiry. |
| `-h`, `--help`            | bool   | help for api-key                                                                                                                                                     |
| `-o`, `--output`          | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")                                                                          |
| `-s`, `--service-account` | string | The name of the service account whose API keys are managed.                                                                                                          |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="create an API key for a service account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create api-key 
    	--service-account yourServiceAccountName 
    	--description "key for CI" 

    ```
  </Accordion>

  <Accordion title="create an API key that expires on a given date">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create api-key 
    	--service-account yourServiceAccountName 
    	--description "key for CI" 
    	--expires-at 2026-12-31 
    ```
  </Accordion>
</AccordionGroup>


# kosli create attestation-type
Source: https://docs.kosli.com/client_reference/kosli_create_attestation-type

Create or update a Kosli custom attestation type.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create attestation-type TYPE-NAME [flags]
```

Create or update a Kosli custom attestation type.
You can specify attestation type parameters in flags.

`TYPE-NAME` must start with a letter or number, and only contain letters, numbers, `.`, `-`, `_`, and `~`.

`--schema` is a path to a file containing a JSON schema which will be used to validate attestations made using this type.
The schema is used to specify the structure of the attestation data, e.g. any fields that are required or
the expected type of the data.
See an example schema file
[here](https://github.com/cyber-dojo/kosli-attestation-types/blob/f9130c58d3a8151b0b0e7c5db284e4380eb2d2cf/metrics-coverage.schema.json).

`--jq` defines an evaluation rule, given in `jq`-format, for this attestation type. The flag can be repeated in order to add additional rules.
These rules specify acceptable values for attestation data, e.g. `.age >= 21` or `.failing_tests == 0`.
When a custom attestation is reported, the provided data is evaluated according to the rules defined in its attestation-type.
All rules must return `true` for the evaluation to pass and the attestation to be determined compliant.

`--summary` defines one entry of the summary shown for attestations of this type, given as
`'NAME=EXPRESSION'` where the expression is a `jq` expression evaluated against the attestation data.
The flag can be repeated to add further entries, which are displayed in the order given, e.g.
`--summary "Critical=.critical_count" --summary "Tool=.scanner.name"`.
Each value is split on its first `=` only, so `jq` expressions containing `==` are unaffected.

`--summary-json` is an alternative to `--summary` for summaries that are easier to express as JSON,
given as a JSON array of `\{"name": ..., "expression": ...\}` entries, e.g.
`'[\{"name":"Critical","expression":".critical_count"\}]'`. The two summary flags cannot be combined.

Attestation types created without a summary fall back to the `jq` evaluation rules checklist.

## Flags

| Flag                  | Type        | Description                                                                                                                                                                                      |
| :-------------------- | :---------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-d`, `--description` | string      | \[optional] The attestation type description.                                                                                                                                                    |
| `-D`, `--dry-run`     | bool        | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                             |
| `-h`, `--help`        | bool        | help for attestation-type                                                                                                                                                                        |
| `--jq`                | stringArray | \[optional] The attestation type evaluation JQ rules.                                                                                                                                            |
| `-s`, `--schema`      | string      | \[optional] Path to the attestation type schema in JSON Schema format.                                                                                                                           |
| `--summary`           | stringArray | \[optional] An attestation type summary entry, given as 'NAME=EXPRESSION'. Can be repeated. Cannot be used with `--summary-json`.                                                                |
| `--summary-json`      | string      | \[optional] The attestation type summary, given as a JSON array of \{name, expression} entries, e.g. '\[\{"name":"Critical","expression":".critical\_count"}]'. Cannot be used with `--summary`. |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli create attestation-type` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/kosli-attestation-types/blob/e115b88d482df7563cb10ac4fe80bdc34aad1209/.github/workflows/main.yml#L50)
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="create/update a custom attestation type with no schema no evaluation rules">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create attestation-type customTypeName

    ```
  </Accordion>

  <Accordion title="create/update a custom attestation type with schema and `jq` evaluation rules">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create attestation-type customTypeName 
        --description "Attest that a person meets the age requirements." 
        --schema person-schema.json 
        --jq ".age >= 18"
        --jq ".age < 65"

    ```
  </Accordion>

  <Accordion title="create/update a custom attestation type with a summary">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create attestation-type customTypeName 
        --schema scan-schema.json 
        --summary "Critical=.critical_count" 
        --summary "Tool=.scanner.name"

    ```
  </Accordion>

  <Accordion title="create/update a custom attestation type with a summary given as JSON">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create attestation-type customTypeName 
        --schema scan-schema.json 
        --summary-json '[{"name":"Critical","expression":".critical_count"},{"name":"Tool","expression":".scanner.name"}]'
    ```
  </Accordion>
</AccordionGroup>


# kosli create control
Source: https://docs.kosli.com/client_reference/kosli_create_control

Create a Kosli control.

<Warning>
  This is a beta feature. Beta features provide early access to product
  functionality. These features may change between releases without warning, or
  can be removed in a future release. Please contact us to enable this feature
  for your organization.
</Warning>

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create control CONTROL-IDENTIFIER [flags]
```

Create a Kosli control.

`CONTROL-IDENTIFIER` must start with a letter or number, and only contain letters, numbers, `.`, `-`, `_`, and `~`.

## Flags

| Flag                  | Type   | Description                                                                                                                          |
| :-------------------- | :----- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-d`, `--description` | string | \[optional] The control description.                                                                                                 |
| `-D`, `--dry-run`     | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`        | bool   | help for control                                                                                                                     |
| `-n`, `--name`        | string | \[required] The control name.                                                                                                        |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="create a Kosli control">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create control yourControlIdentifier 
    	--name "Your control name" 
    	--description "what this control checks" 
    ```
  </Accordion>
</AccordionGroup>


# kosli create environment
Source: https://docs.kosli.com/client_reference/kosli_create_environment

Create or update a Kosli environment.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create environment ENVIRONMENT-NAME [flags]
```

Create or update a Kosli environment.

`--type` must match the type of environment you wish to record snapshots from.
The following types are supported:

* k8s        - Kubernetes
* ecs        - Amazon Elastic Container Service
* s3         - Amazon S3 object storage
* lambda     - AWS Lambda serverless
* docker     - Docker images
* azure-apps - Azure app services
* server     - Generic type
* logical    - Logical grouping of real environments

Logical environments are used for grouping of physical environments. For instance **prod-aws** and **prod-s3** can
be grouped into logical environment **prod**. Logical environments are view-only, you can not report snapshots
to them.

`ENVIRONMENT-NAME`s must start with a letter or number, and only contain letters, numbers, `.`, `-` and `_`.

## Flags

| Flag                      | Type    | Description                                                                                                                                                                                                                                              |
| :------------------------ | :------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-d`, `--description`     | string  | \[optional] The environment description.                                                                                                                                                                                                                 |
| `-D`, `--dry-run`         | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                     |
| `--exclude-scaling`       | bool    | \[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) |
| `-h`, `--help`            | bool    | help for environment                                                                                                                                                                                                                                     |
| `--include-scaling`       | bool    | \[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)     |
| `--included-environments` | strings | \[optional] Comma separated list of environments to include in logical environment                                                                                                                                                                       |
| `--require-provenance`    | bool    | \[defaulted] Require provenance for all artifacts running in environment snapshots. (DEPRECATED: this flag is deprecated and will be removed in a future version. Use policies instead.)                                                                 |
| `-t`, `--type`            | string  | The type of environment. Valid types are: \[K8S, ECS, S3, lambda, server, docker, azure-apps, cloud-run, logical].                                                                                                                                       |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="create a Kosli environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create environment yourEnvironmentName
    	--type K8S 
    	--description "my new env" 

    ```
  </Accordion>

  <Accordion title="create a Kosli logical environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create environment yourLogicalEnvironmentName
    	--type logical 
    	--included-environments realEnv1,realEnv2,realEnv3
    	--description "my full prod" 
    ```
  </Accordion>
</AccordionGroup>


# kosli create flow
Source: https://docs.kosli.com/client_reference/kosli_create_flow

Create or update a Kosli flow.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create flow FLOW-NAME [flags]
```

Create or update a Kosli flow.
You can specify flow parameters in flags.

`FLOW-NAME`s must start with a letter or number, and only contain letters, numbers, `.`, `-`, `_`, and `~`.

## Flags

| Flag                    | Type    | Description                                                                                                                                                                                     |
| :---------------------- | :------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--description`         | string  | \[optional] The Kosli flow description.                                                                                                                                                         |
| `-D`, `--dry-run`       | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                            |
| `-h`, `--help`          | bool    | help for flow                                                                                                                                                                                   |
| `-t`, `--template`      | strings | \[defaulted] The comma-separated list of required compliance controls names.                                                                                                                    |
| `-f`, `--template-file` | string  | \[optional] The path to a yaml template file. Cannot be used together with `--use-empty-template`                                                                                               |
| `--use-empty-template`  | bool    | Use an empty template for the flow creation without specifying a file. Cannot be used together with `--template` or `--template-file`                                                           |
| `--visibility`          | string  | \[deprecated] The visibility of the Kosli flow. This flag is deprecated and will be removed in a future version. (DEPRECATED: this flag is deprecated and will be removed in a future version.) |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli create flow` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/runner/blob/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9/.github/workflows/main.yml#L62)
  </Tab>

  <Tab title="GitLab">
    View an example of the `kosli create flow` command in GitLab.

    In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L53)
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="create/update a Kosli flow (with empty template)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create flow yourFlowName 
    	--description yourFlowDescription 
    	--use-empty-template 

    ```
  </Accordion>

  <Accordion title="create/update a Kosli flow (with template file)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create flow yourFlowName 
    	--description yourFlowDescription 
    	--template-file /path/to/your/template/file.yml 
    ```
  </Accordion>
</AccordionGroup>


# kosli create policy
Source: https://docs.kosli.com/client_reference/kosli_create_policy

Create or update a Kosli policy.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create policy POLICY-NAME POLICY-FILE-PATH [flags]
```

Updating policy content creates a new version of the policy.

## Flags

| Flag              | Type   | Description                                                                                                                          |
| :---------------- | :----- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `--comment`       | string | \[optional] comment about the change made in a policy file when updating a policy.                                                   |
| `--description`   | string | \[optional] policy description.                                                                                                      |
| `-D`, `--dry-run` | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool   | help for policy                                                                                                                      |
| `--type`          | string | \[defaulted] the type of policy. One of: \[env] (default "env")                                                                      |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="create a Kosli policy">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create policy yourPolicyName yourPolicyFile.yml 
    	--description yourPolicyDescription 
    	--type env 

    ```
  </Accordion>

  <Accordion title="update a Kosli policy">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create policy yourPolicyName yourPolicyFile.yml 
    	--description yourPolicyDescription 
    	--type env 
    	--comment yourChangeComment 
    ```
  </Accordion>
</AccordionGroup>


# kosli create service-account
Source: https://docs.kosli.com/client_reference/kosli_create_service-account

Create a service account.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create service-account SERVICE-ACCOUNT-NAME [flags]
```

Create a service account.

A service account is a non-human identity in your organization. API keys are
created separately for it with `kosli create api-key`.

## Flags

| Flag                  | Type   | Description                                                                                                                          |
| :-------------------- | :----- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-d`, `--description` | string | \[optional] A description for the service account.                                                                                   |
| `-D`, `--dry-run`     | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`        | bool   | help for service-account                                                                                                             |
| `--privilege`         | string | The privilege granted to the service account. One of: \[admin, member, snapshotter, reader].                                         |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="create a service account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create service-account yourServiceAccountName 
    	--privilege member 
    	--description "CI service account" 
    ```
  </Accordion>
</AccordionGroup>


# kosli delete api-key
Source: https://docs.kosli.com/client_reference/kosli_delete_api-key

Delete one or more API keys for a service account.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli delete api-key KEY-ID [KEY-ID...] [flags]
```

Delete one or more API keys for a service account.

This permanently deletes the API key(s) identified by KEY-ID. Deletion is immediate and
cannot be undone. You are asked to confirm before the key is deleted; use
`--assume-yes`/`--yes` to skip the confirmation prompt.

When stdin is not interactive (e.g. in CI) the prompt cannot be answered and the
command fails without deleting anything, so pass `--assume-yes` there.

## Flags

| Flag                      | Type   | Description                                                                                                                          |
| :------------------------ | :----- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-y`, `--assume-yes`      | bool   | \[optional] Skip the confirmation prompt and delete the API key without asking. (alias: `--yes`)                                     |
| `-D`, `--dry-run`         | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`            | bool   | help for api-key                                                                                                                     |
| `-s`, `--service-account` | string | The name of the service account whose API keys are managed.                                                                          |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="delete an API key for a service account (asks for confirmation)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli delete api-key yourApiKeyID 
    	--service-account yourServiceAccountName 

    ```
  </Accordion>

  <Accordion title="delete multiple API keys at once">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli delete api-key keyID1 keyID2 
    	--service-account yourServiceAccountName 

    ```
  </Accordion>

  <Accordion title="delete an API key without confirmation">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli delete api-key yourApiKeyID 
    	--service-account yourServiceAccountName 
    	--assume-yes 
    ```
  </Accordion>
</AccordionGroup>


# kosli delete service-account
Source: https://docs.kosli.com/client_reference/kosli_delete_service-account

Delete one or more service accounts.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli delete service-account SERVICE-ACCOUNT-NAME [SERVICE-ACCOUNT-NAME...] [flags]
```

Delete one or more service accounts.

This permanently removes the service account(s) identified by SERVICE-ACCOUNT-NAME
from the organization, along with their API keys. Deletion is immediate and
cannot be undone. You are asked to confirm before deletion; use
`--assume-yes`/`--yes` to skip the confirmation prompt.

When stdin is not interactive (e.g. in CI) the prompt cannot be answered and the
command fails without deleting anything, so pass `--assume-yes` there.

## Flags

| Flag                 | Type | Description                                                                                                                          |
| :------------------- | :--- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-y`, `--assume-yes` | bool | \[optional] Skip the confirmation prompt and delete the service account without asking. (alias: `--yes`)                             |
| `-D`, `--dry-run`    | bool | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`       | bool | help for service-account                                                                                                             |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="delete a service account (asks for confirmation)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli delete service-account yourServiceAccountName 

    ```
  </Accordion>

  <Accordion title="delete multiple service accounts at once">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli delete service-account sa1 sa2 

    ```
  </Accordion>

  <Accordion title="delete a service account without confirmation">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli delete service-account yourServiceAccountName 
    	--assume-yes 
    ```
  </Accordion>
</AccordionGroup>


# kosli detach-policy
Source: https://docs.kosli.com/client_reference/kosli_detach-policy

Detach a policy from one or more Kosli environments.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli detach-policy POLICY-NAME [flags]
```

If the environment has no more policies attached to it, then its snapshots' status will become "unknown".

## Flags

| Flag                  | Type    | Description                                                                                                                          |
| :-------------------- | :------ | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run`     | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-e`, `--environment` | strings | the list of environment names to detach the policy from                                                                              |
| `-h`, `--help`        | bool    | help for detach-policy                                                                                                               |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="detach policy from multiple environments">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli detach-policy yourPolicyName 
    	--environment yourFirstEnvironmentName 
    	--environment yourSecondEnvironmentName 
    ```
  </Accordion>
</AccordionGroup>


# kosli diff snapshots
Source: https://docs.kosli.com/client_reference/kosli_diff_snapshots

Diff environment snapshots.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli diff snapshots SNAPPISH_1 SNAPPISH_2 [flags]
```

Diff environment snapshots.\
Specify SNAPPISH\_1 and SNAPPISH\_2 by:

* environmentName
  * the latest snapshot for environmentName, at the time of the request
  * e.g., **prod**
* environmentName#N
  * the Nth snapshot, counting from 1
  * e.g., **prod#42**
* environmentName\~N
  * the Nth snapshot behind the latest, at the time of the request
  * e.g., **prod\~5**
* environmentName@\{YYYY-MM-DDTHH:MM:SS}
  * the snapshot at specific moment in time in UTC
  * e.g., **prod@\{2023-10-02T12:00:00}**
* environmentName@\{N.`hours|days|weeks|months`.ago}
  * the snapshot at a time relative to the time of the request
  * e.g., **prod@\{2.hours.ago}**

## Flags

| Flag                     | Type   | Description                                                                                 |
| :----------------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`           | bool   | help for snapshots                                                                          |
| `-o`, `--output`         | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |
| `-u`, `--show-unchanged` | bool   | \[defaulted] Show the unchanged artifacts present in both snapshots within the diff output. |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Example

To view a live example of 'kosli diff snapshots' you can run the command below (for the [cyber-dojo](https://app.kosli.com/cyber-dojo) demo organization).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
# The API token below is read-only
export KOSLI_API_TOKEN=Pj_XT2deaVA6V1qrTlthuaWsmjVt4eaHQwqnwqjRO3A
kosli diff snapshots aws-beta aws-prod --output=json
```

<Accordion title="View example output">
  <div>
    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    {
      "snappish1": {
        "snapshot_id": "aws-beta#8249",
        "artifacts": []
      },
      "snappish2": {
        "snapshot_id": "aws-prod#5309",
        "artifacts": []
      },
      "changed": {
        "artifacts": []
      },
      "not-changed": {
        "artifacts": [
          {
            "fingerprint": "03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
            "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:bcac1c1@sha256:03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
            "most_recent_timestamp": 1788255749,
            "flow": "differ-ci",
            "commit_url": "https://github.com/cyber-dojo/differ/commit/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
            "instance_count": 1
          },
          {
            "fingerprint": "06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
            "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:84e986a@sha256:06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
            "most_recent_timestamp": 1788255396,
            "flow": "saver-ci",
            "commit_url": "https://github.com/cyber-dojo/saver/commit/84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
            "instance_count": 1
          },
          {
            "fingerprint": "1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
            "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:27b3504@sha256:1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
            "most_recent_timestamp": 1788255750,
            "flow": "nginx-ci",
            "commit_url": "https://github.com/cyber-dojo/nginx/commit/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
            "instance_count": 1
          },
          {
            "fingerprint": "2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
            "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:ff9f292@sha256:2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
            "most_recent_timestamp": 1788255387,
            "flow": "dashboard-ci",
            "commit_url": "https://github.com/cyber-dojo/dashboard/commit/ff9f292e809801d35246183988b7812826bc2760",
            "instance_count": 1
          },
          {
            "fingerprint": "28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
            "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:a357ebd@sha256:28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
            "most_recent_timestamp": 1788255750,
            "flow": "languages-start-points-ci",
            "commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/a357ebd85acdd54968fa0192405aaf2e289d27c9",
            "instance_count": 1
          },
          {
            "fingerprint": "34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
            "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:b12a5c9@sha256:34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
            "most_recent_timestamp": 1788255398,
            "flow": "custom-start-points-ci",
            "commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/b12a5c9b17023462d13e81381a69c7ef05f84dc2",
            "instance_count": 1
          },
          {
            "fingerprint": "36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
            "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:cbe481c@sha256:36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
            "most_recent_timestamp": 1788074889,
            "flow": "web-ci",
            "commit_url": "https://github.com/cyber-dojo/web/commit/cbe481c4b842f897e4e9e411cd78461a3a12a334",
            "instance_count": 3
          },
          {
            "fingerprint": "41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
            "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:f22a30e@sha256:41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
            "most_recent_timestamp": 1788255396,
            "flow": "exercises-start-points-ci",
            "commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
            "instance_count": 1
          },
          {
            "fingerprint": "6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
            "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:90c8d98@sha256:6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
            "most_recent_timestamp": 1788255396,
            "flow": "spooler-ci",
            "commit_url": "https://github.com/cyber-dojo/spooler/commit/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
            "instance_count": 1
          },
          {
            "fingerprint": "a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
            "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:ca65b67@sha256:a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
            "most_recent_timestamp": 1788255844,
            "flow": "runner-ci",
            "commit_url": "https://github.com/cyber-dojo/runner/commit/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
            "instance_count": 3
          },
          {
            "fingerprint": "c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
            "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:d64d2b1@sha256:c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
            "most_recent_timestamp": 1788256052,
            "flow": "creator-ci",
            "commit_url": "https://github.com/cyber-dojo/creator/commit/d64d2b11879179255f11dc991e81fbaf4a040264",
            "instance_count": 1
          }
        ]
      }
    }
    ```
  </div>
</Accordion>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="compare the third latest snapshot in an environment to the latest">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli diff snapshots envName~3 envName 

    ```
  </Accordion>

  <Accordion title="compare snapshots of two different environments of the same type">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli diff snapshots envName1 envName2 

    ```
  </Accordion>

  <Accordion title="show the not-changed artifacts in both snapshots">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli diff snapshots envName1 envName2 
    	--show-unchanged 

    ```
  </Accordion>

  <Accordion title="compare the snapshot from 2 weeks ago in an environment to the latest">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli diff snapshots envName@{2.weeks.ago} envName 
    ```
  </Accordion>
</AccordionGroup>


# kosli disable beta
Source: https://docs.kosli.com/client_reference/kosli_disable_beta

Disable beta features for an organization.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli disable beta [flags]
```

Disable beta features for an organization.

## Flags

| Flag           | Type | Description   |
| :------------- | :--- | :------------ |
| `-h`, `--help` | bool | help for beta |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |


# kosli enable beta
Source: https://docs.kosli.com/client_reference/kosli_enable_beta

Enable beta features for an organization.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli enable beta [flags]
```

Enable beta features for an organization.

## Flags

| Flag           | Type | Description   |
| :------------- | :--- | :------------ |
| `-h`, `--help` | bool | help for beta |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |


# kosli evaluate input
Source: https://docs.kosli.com/client_reference/kosli_evaluate_input

Evaluate a local JSON input against a Rego policy.

<Warning>
  This is a beta feature. Beta features provide early access to product
  functionality. These features may change between releases without warning, or
  can be removed in a future release. Please contact us to enable this feature
  for your organization.
</Warning>

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli evaluate input [flags]
```

Evaluate a local JSON input against a Rego policy.
Read JSON from a file or stdin and evaluate it against a Rego policy.
The input file should contain the raw JSON object your policy expects —
not the wrapper produced by `--show-input`. Use `jq '.input'` to extract
the policy input from a `--show-input --output json` capture.

The policy must use `package policy` and define an `allow` rule.
An optional `violations` rule (a set of strings) can provide human-readable denial reasons.

By default a deny exits with code 1. Pass `--no-assert` to print the verdict
and exit 0 even on deny, when this command is feeding another tool as a
policy decision point.

When `--input-file` is omitted, JSON is read from stdin.

Use `--params` to pass configuration data to the policy as `data.params`.
This accepts inline JSON or a file reference (`@file.json`).

## Flags

| Flag                 | Type   | Description                                                                                                                                        |
| :------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--assert`           | bool   | \[optional] Exit with a non-zero status when the policy denies. This is the current default; pass `--assert` to lock it in across future releases. |
| `-h`, `--help`       | bool   | help for input                                                                                                                                     |
| `-i`, `--input-file` | string | \[optional] Path to a JSON input file. Reads from stdin if omitted.                                                                                |
| `--no-assert`        | bool   | \[optional] Print the result and always exit 0, even when the policy denies. Use when this command feeds another tool as a policy decision point.  |
| `-o`, `--output`     | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")                                                        |
| `--params`           | string | \[optional] Policy parameters as inline JSON or @file.json. Available in policies as data.params.                                                  |
| `-p`, `--policy`     | string | Path or http(s):// URL of a Rego policy to evaluate against the input.                                                                             |
| `--show-input`       | bool   | \[optional] Include the policy input data in the output.                                                                                           |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli evaluate input` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/snyk-scanning/blob/ed3c81d7322bb8058615095f4aab28c147c53933/tests/test_rego_rules.sh#L286)
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="capture trail data for local policy iteration">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trail TRAIL --flow FLOW 
    	--policy allow-all.rego 
    	--show-input --output json | jq '.input' > trail-data.json

    ```
  </Accordion>

  <Accordion title="then iterate on your policy locally">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate input 
    	--input-file trail-data.json 
    	--policy policy.rego

    ```
  </Accordion>

  <Accordion title="evaluate and show the data passed to the policy">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate input 
    	--input-file trail-data.json 
    	--policy policy.rego 
    	--show-input 
    	--output json

    ```
  </Accordion>

  <Accordion title="read input from stdin">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    cat trail-data.json | kosli evaluate input 
    	--policy policy.rego

    ```
  </Accordion>

  <Accordion title="evaluate with policy parameters (inline JSON)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate input 
    	--input-file trail-data.json 
    	--policy policy.rego 
    	--params '{"threshold": 3}'

    ```
  </Accordion>

  <Accordion title="evaluate with policy parameters from a file">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate input 
    	--input-file trail-data.json 
    	--policy policy.rego 
    	--params @params.json

    ```
  </Accordion>

  <Accordion title="evaluate using a policy fetched from a remote URL">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate input 
    	--input-file trail-data.json 
    	--policy https://policies.example.com/policy.rego

    ```
  </Accordion>

  <Accordion title="evaluate as a decision point (print verdict, never fail the step)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate input 
    	--input-file trail-data.json 
    	--policy policy.rego 
    	--no-assert
    ```
  </Accordion>
</AccordionGroup>


# kosli evaluate trail
Source: https://docs.kosli.com/client_reference/kosli_evaluate_trail

Evaluate a trail against a policy.

<Warning>
  This is a beta feature. Beta features provide early access to product
  functionality. These features may change between releases without warning, or
  can be removed in a future release. Please contact us to enable this feature
  for your organization.
</Warning>

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli evaluate trail TRAIL-NAME [flags]
```

Evaluate a trail against a policy.
Fetch a single trail from Kosli and evaluate it against a Rego policy.
The trail data is passed to the policy as `input.trail`.

Use `--attestations` to enrich the input with detailed attestation data
(e.g. pull request approvers, scan results). Use `--show-input` to inspect the
full data structure available to the policy. Use `--output json` for structured output.

## Flags

| Flag             | Type    | Description                                                                                                                                        |
| :--------------- | :------ | :------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--assert`       | bool    | \[optional] Exit with a non-zero status when the policy denies. This is the current default; pass `--assert` to lock it in across future releases. |
| `--attestations` | strings | \[optional] Limit which attestations are included. Plain name for trail-level, dot-qualified (artifact.name) for artifact-level.                   |
| `-f`, `--flow`   | string  | The Kosli flow name.                                                                                                                               |
| `-h`, `--help`   | bool    | help for trail                                                                                                                                     |
| `--no-assert`    | bool    | \[optional] Print the result and always exit 0, even when the policy denies. Use when this command feeds another tool as a policy decision point.  |
| `-o`, `--output` | string  | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")                                                        |
| `--params`       | string  | \[optional] Policy parameters as inline JSON or @file.json. Available in policies as data.params.                                                  |
| `-p`, `--policy` | string  | Path or http(s):// URL of a Rego policy to evaluate against the trail.                                                                             |
| `--show-input`   | bool    | \[optional] Include the policy input data in the output.                                                                                           |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli evaluate trail` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/snyk-scanning/blob/9cc4c900ed581834931a9596a49b5033b7ffa12f/.github/workflows/artifact_snyk_test.yml#L325)
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="evaluate a trail against a policy">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trail yourTrailName 
    	--policy yourPolicyFile.rego 

    ```
  </Accordion>

  <Accordion title="evaluate a trail with attestation enrichment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trail yourTrailName 
    	--policy yourPolicyFile.rego 
    	--attestations pull-request 

    ```
  </Accordion>

  <Accordion title="evaluate a trail and show the policy input data">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trail yourTrailName 
    	--policy yourPolicyFile.rego 
    	--show-input 
    	--output json 

    ```
  </Accordion>

  <Accordion title="evaluate a trail with policy parameters (inline JSON)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trail yourTrailName 
    	--policy yourPolicyFile.rego 
    	--params '{"min_approvers": 2}' 

    ```
  </Accordion>

  <Accordion title="evaluate a trail with policy parameters from a file">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trail yourTrailName 
    	--policy yourPolicyFile.rego 
    	--params @params.json 

    ```
  </Accordion>

  <Accordion title="evaluate a trail using a policy fetched from a remote URL">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trail yourTrailName 
    	--policy https://policies.example.com/trail.rego 

    ```
  </Accordion>

  <Accordion title="evaluate a trail as a decision point (print verdict, never fail the step)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trail yourTrailName 
    	--policy yourPolicyFile.rego 
    	--no-assert 
    ```
  </Accordion>
</AccordionGroup>


# kosli evaluate trails
Source: https://docs.kosli.com/client_reference/kosli_evaluate_trails

Evaluate multiple trails against a policy.

<Warning>
  This is a beta feature. Beta features provide early access to product
  functionality. These features may change between releases without warning, or
  can be removed in a future release. Please contact us to enable this feature
  for your organization.
</Warning>

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli evaluate trails TRAIL-NAME [TRAIL-NAME...] [flags]
```

Evaluate multiple trails against a policy.
Fetch multiple trails from Kosli and evaluate them together against a Rego policy.
The trail data is passed to the policy as `input.trails` (an array), unlike
`evaluate trail` which passes `input.trail` (a single object).

Use `--attestations` to enrich the input with detailed attestation data
(e.g. pull request approvers, scan results). Use `--show-input` to inspect the
full data structure available to the policy. Use `--output json` for structured output.

## Flags

| Flag             | Type    | Description                                                                                                                                        |
| :--------------- | :------ | :------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--assert`       | bool    | \[optional] Exit with a non-zero status when the policy denies. This is the current default; pass `--assert` to lock it in across future releases. |
| `--attestations` | strings | \[optional] Limit which attestations are included. Plain name for trail-level, dot-qualified (artifact.name) for artifact-level.                   |
| `-f`, `--flow`   | string  | The Kosli flow name.                                                                                                                               |
| `-h`, `--help`   | bool    | help for trails                                                                                                                                    |
| `--no-assert`    | bool    | \[optional] Print the result and always exit 0, even when the policy denies. Use when this command feeds another tool as a policy decision point.  |
| `-o`, `--output` | string  | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")                                                        |
| `--params`       | string  | \[optional] Policy parameters as inline JSON or @file.json. Available in policies as data.params.                                                  |
| `-p`, `--policy` | string  | Path or http(s):// URL of a Rego policy to evaluate against the trails.                                                                            |
| `--show-input`   | bool    | \[optional] Include the policy input data in the output.                                                                                           |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="evaluate multiple trails against a policy">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trails yourTrailName1 yourTrailName2 
    	--policy yourPolicyFile.rego 

    ```
  </Accordion>

  <Accordion title="evaluate trails with attestation enrichment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trails yourTrailName1 yourTrailName2 
    	--policy yourPolicyFile.rego 
    	--attestations pull-request 

    ```
  </Accordion>

  <Accordion title="evaluate trails with JSON output and show the policy input">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trails yourTrailName1 yourTrailName2 
    	--policy yourPolicyFile.rego 
    	--show-input 
    	--output json 

    ```
  </Accordion>

  <Accordion title="evaluate trails with policy parameters">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trails yourTrailName1 yourTrailName2 
    	--policy yourPolicyFile.rego 
    	--params '{"min_approvers": 2}' 

    ```
  </Accordion>

  <Accordion title="evaluate trails using a policy fetched from a remote URL">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trails yourTrailName1 yourTrailName2 
    	--policy https://policies.example.com/trails.rego 

    ```
  </Accordion>

  <Accordion title="evaluate trails as a decision point (print verdict, never fail the step)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trails yourTrailName1 yourTrailName2 
    	--policy yourPolicyFile.rego 
    	--no-assert 
    ```
  </Accordion>
</AccordionGroup>


# kosli fingerprint
Source: https://docs.kosli.com/client_reference/kosli_fingerprint

Calculate the SHA256 fingerprint of an artifact.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli fingerprint {IMAGE-NAME | FILE-PATH | DIR-PATH} [flags]
```

Calculate the SHA256 fingerprint of an artifact.
Requires `--artifact-type` flag to be set.
Artifact type can be one of: "file" for files, "dir" for directories, "oci" for container
images in registries or "docker" for local docker images.

Fingerprinting container images can be done using the local docker daemon or the fingerprint can be fetched
from a remote registry.

Note: `--artifact-type=docker` reads the image's repo digest via the local Docker daemon, so
the image must have been pushed to or pulled from a registry. A freshly built image (just
`docker build`) does not have a repo digest. For images already in a registry, prefer
`--artifact-type=oci` to fetch the digest directly from the registry.

When fingerprinting a 'dir' artifact, you can exclude certain paths from fingerprint calculation
using the `--exclude` flag.
Excluded paths are relative to the DIR-PATH and can be literal paths or glob patterns.
With a directory structure like this `foo/bar/zam/file.txt` if you are calculating the fingerprint of `foo/bar` you need to
exclude `zam/file.txt` which is relative to the DIR-PATH.
The supported glob pattern syntax is what is documented here: [https://pkg.go.dev/path/filepath#Match](https://pkg.go.dev/path/filepath#Match) ,
plus the ability to use recursive globs "\*\*"

If the directory structure contains a symbolic link to a *file* (for example, a link 'from/this/file' and a target of 'to/another/file') then:

* the name of the link ('from/this/file') *is* included in the fingerprint.
* the name of the link ('from/this/file') *is* subject to `.kosli_ignore` entries.
* the name of the target ('to/another/file') is *not* included in the fingerprint.
* the content of target *is* included in the fingerprint, even if the target is outside the root directory being fingerprinted.

If the directory structure contains a symbolic link to a *directory* (for example, a link 'from/this/dir' and a target of 'to/another/dir') then:

* the name of the link ('from/this/dir') *is* included in the fingerprint.
* the name of the link ('from/this/dir') *is* subject to `.kosli_ignore` entries.
* the name of the target ('to/another/dir') *is* included in the fingerprint, even if the target is outside the root directory being fingerprinted.
* the name of the target ('to/another/dir') is *not* subject to `.kosli_ignore` entries.
* the content of the target is *not* included in the fingerprint.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

## Flags

| Flag                    | Type    | Description                                                                                                                                                                                                                                            |
| :---------------------- | :------ | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-t`, `--artifact-type` | string  | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).       |
| `-e`, `--e`             | strings | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir. (DEPRECATED: use `-x` instead)                                                        |
| `-x`, `--exclude`       | strings | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                       |
| `-h`, `--help`          | bool    | help for fingerprint                                                                                                                                                                                                                                   |
| `--registry-password`   | string  | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
| `--registry-provider`   | string  | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                            |
| `--registry-username`   | string  | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                 |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli fingerprint` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/snyk-scanning/blob/ed3c81d7322bb8058615095f4aab28c147c53933/.github/workflows/artifact_snyk_test.yml#L179)
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="fingerprint a file">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli fingerprint --artifact-type file file.txt

    ```
  </Accordion>

  <Accordion title="fingerprint a dir">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli fingerprint --artifact-type dir mydir

    ```
  </Accordion>

  <Accordion title="fingerprint a dir while excluding paths `mydir/logs` and `mydir/*.exe`">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli fingerprint --artifact-type dir --exclude logs --exclude *.exe mydir

    ```
  </Accordion>

  <Accordion title="fingerprint a dir while excluding all `.pyc` files">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli fingerprint --artifact-type dir  --exclude **/*.pyc mydir

    ```
  </Accordion>

  <Accordion title="fingerprint a dir while excluding paths in `.kosli_ignore` file">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    echo bar/file.txt > mydir/.kosli_ignore
    kosli fingerprint --artifact-type dir mydir

    ```
  </Accordion>

  <Accordion title="fingerprint a locally available docker image (requires docker daemon running)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli fingerprint --artifact-type docker nginx:latest

    ```
  </Accordion>

  <Accordion title="fingerprint a public image from a remote registry">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli fingerprint --artifact-type oci nginx:latest

    ```
  </Accordion>

  <Accordion title="fingerprint a private image from a remote registry">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli fingerprint --artifact-type oci private:latest \
      --registry-username YourUsername \
      --registry-password YourPassword
    ```
  </Accordion>
</AccordionGroup>


# kosli get api-key
Source: https://docs.kosli.com/client_reference/kosli_get_api-key

Get an API key's metadata for a service account.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get api-key KEY-ID [flags]
```

Get an API key's metadata for a service account.

Only the metadata of the API key is returned; the key value itself is never
returned (it is only shown once, at creation or rotation time).

## Flags

| Flag                      | Type   | Description                                                                                 |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`            | bool   | help for api-key                                                                            |
| `-o`, `--output`          | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |
| `-s`, `--service-account` | string | The name of the service account whose API keys are managed.                                 |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="get the metadata of an API key">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get api-key yourApiKeyID 
    	--service-account yourServiceAccountName 
    ```
  </Accordion>
</AccordionGroup>


# kosli get artifact
Source: https://docs.kosli.com/client_reference/kosli_get_artifact

Get artifact from a specified flow

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get artifact EXPRESSION [flags]
```

Get artifact from a specified flow
You can get an artifact by its fingerprint or by its git commit sha.
In case of using the git commit, it is possible to get multiple artifacts matching the git commit.

The expected argument is an expression to specify the artifact to get.
It has the format `FLOW_NAME``SEPARATOR``COMMIT_SHA1|ARTIFACT_FINGERPRINT`

Expression can be specified as follows:

* flowName@`fingerprint`  artifact with a given fingerprint. The fingerprint can be short or complete.
* flowName:`commit_sha`   artifact with a given commit SHA. The commit sha can be short or complete.

Examples of valid expressions are:

* flow\@184c799cd551dd1d8d5c5f9a5d593b2e931f5e36122ee5c793c1d08a19839cc0
* flow\@184c7
* flow:110d048bf1fce72ba546cbafc4427fb21b958dee
* flow:110d0

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for artifact                                                                           |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |
| `-t`, `--trail`  | string | \[optional] The Kosli trail name.                                                           |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="get an artifact with a given fingerprint from a flow">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get artifact flowName@fingerprint 

    ```
  </Accordion>

  <Accordion title="get the latest artifact with a given fingerprint from a flow in a specific trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get artifact flowName@fingerprint 

    ```
  </Accordion>

  <Accordion title="get an artifact with a given commit SHA from a flow">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get artifact flowName:commitSHA 

    ```
  </Accordion>

  <Accordion title="get a list of artifacts with a given commit SHA from a flow in a particular trail">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get artifact flowName:commitSHA 
    ```
  </Accordion>
</AccordionGroup>


# kosli get attestation
Source: https://docs.kosli.com/client_reference/kosli_get_attestation

Get an attestation using its name or id.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get attestation [ATTESTATION-NAME] [flags]
```

Get an attestation using its name or id.

You can get an attestation from a trail or artifact using its name. The attestation name should be given
WITHOUT dot-notation.\
To get an attestation from a trail, specify the trail name using the `--trail` flag.\
To get an attestation from an artifact, specify the artifact fingerprint using the `--fingerprint` flag.\
These flags cannot be used together. In both cases the flow must also be specified using the `--flow` flag.\
If there are multiple attestations with the same name on the trail or artifact, a list of all will be returned.

You can also get an attestation by its id using the `--attestation-id` flag. This cannot be used with the attestation name,
or any of the `--flow`, `--trail` or `--fingerprint` flags.

## Flags

| Flag                  | Type   | Description                                                                                                                                            |
| :-------------------- | :----- | :----------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--attestation-id`    | string | \[conditional] The unique identifier of the attestation to retrieve. Cannot be used together with ATTESTATION-NAME.                                    |
| `-F`, `--fingerprint` | string | \[conditional] The fingerprint of the artifact for the attestation. Cannot be used together with `--trail` or `--attestation-id`.                      |
| `-f`, `--flow`        | string | \[conditional] The name of the Kosli flow for the attestation. Required if ATTESTATION-NAME provided. Cannot be used together with `--attestation-id`. |
| `-h`, `--help`        | bool   | help for attestation                                                                                                                                   |
| `-o`, `--output`      | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")                                                            |
| `-t`, `--trail`       | string | \[conditional] The name of the Kosli trail for the attestation. Cannot be used together with `--fingerprint` or `--attestation-id`.                    |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Example

To view a live example of 'kosli get attestation' you can run the command below (for the [cyber-dojo](https://app.kosli.com/cyber-dojo) demo organization).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
# The API token below is read-only
export KOSLI_API_TOKEN=Pj_XT2deaVA6V1qrTlthuaWsmjVt4eaHQwqnwqjRO3A
kosli get attestation snyk-container-scan --flow=differ-ci --fingerprint=0cbbe3a6e73e733e8ca4b8813738d68e824badad0508ff20842832b5143b48c0 --output=json
```

<Accordion title="View example output">
  <div>
    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    [
      {
        "schema_version": 2,
        "attestation_type": "snyk",
        "attestation_name": "snyk-container-scan",
        "is_compliant": true,
        "origin_url": "https://github.com/cyber-dojo/differ/actions/runs/14975901658",
        "artifact_fingerprint": "0cbbe3a6e73e733e8ca4b8813738d68e824badad0508ff20842832b5143b48c0",
        "target_artifacts": [
          "differ"
        ],
        "git_commit_info": {
          "sha1": "5ccc5c141fdd1fbd97905b7fe0af87e5a592bfb6",
          "message": "Dockerfile - Automated base-image update (#317)\n\nCo-authored-by: JonJagger@users.noreply.github.com <{{ github.actor }}>",
          "author": "Jon Jagger <jon@kosli.com>",
          "branch": "main",
          "timestamp": 1747062671.0,
          "url": "https://github.com/cyber-dojo/differ/commit/5ccc5c141fdd1fbd97905b7fe0af87e5a592bfb6"
        },
        "evidence_archive_path": "83acb2bc-2c26-48a7-8b87-90dfcce7/artifact_attestation/05c2fd70-0832-4868-9e56-e268b720/evidence.tgz",
        "evidence_archive_fingerprint": "8b671e582ee8c9550bb76fb8cef8cb5b4b9f5481737e42f44ad272c931bd82ba",
        "user_data": {},
        "created_at": 1747062776.797778,
        "processed_snyk_results": {
          "schema_version": 1,
          "tool": {
            "name": "Snyk Container",
            "version": "1.1296.2"
          },
          "results": [
            {
              "low_count": 0,
              "medium_count": 0,
              "high_count": 0
            },
            {
              "low_count": 0,
              "medium_count": 0,
              "high_count": 0
            }
          ]
        },
        "attestation_id": "f7cd9b3a-2738-47e6-be36-689d511d",
        "html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/5ccc5c141fdd1fbd97905b7fe0af87e5a592bfb6?attestation_id=f7cd9b3a-2738-47e6-be36-689d511d",
        "flow_name": "differ-ci",
        "trail_name": "5ccc5c141fdd1fbd97905b7fe0af87e5a592bfb6",
        "reported_by": "ci-pipelines",
        "has_audit_package": true,
        "_links": {
          "self": {
            "href": "https://app.kosli.com/api/v2/attestations/cyber-dojo/differ-ci/artifact/0cbbe3a6e73e733e8ca4b8813738d68e824badad0508ff20842832b5143b48c0/snyk-container-scan"
          },
          "evidence": {
            "href": "https://app.kosli.com/api/v2/attestations/cyber-dojo/differ-ci/trail/5ccc5c141fdd1fbd97905b7fe0af87e5a592bfb6/attestation/f7cd9b3a-2738-47e6-be36-689d511d/evidence"
          }
        }
      }
    ]
    ```
  </div>
</Accordion>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="get an attestation by name from a trail (requires the --trail flag)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get attestation attestationName 

    ```
  </Accordion>

  <Accordion title="get an attestation by name from an artifact">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get attestation attestationName 
    	--fingerprint fingerprint

    ```
  </Accordion>

  <Accordion title="get an attestation by its id">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get attestation --attestation-id attestationID
    ```
  </Accordion>
</AccordionGroup>


# kosli get attestation-type
Source: https://docs.kosli.com/client_reference/kosli_get_attestation-type

Get a custom Kosli attestation type.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get attestation-type TYPE-NAME [flags]
```

Get a custom Kosli attestation type.\
The TYPE-NAME can be specified as follows:

* customTypeName
  * Returns the unversioned custom attestation type, containing details of all versions of the type.
  * e.g. `custom-type`
* customTypeName\@vN
  * Returns the Nth version of the custom attestation type.
  * If a non-integer version number is given, the unversioned custom attestation type is returned.
  * e.g. `custom-type@v4`

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for attestation-type                                                                   |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="get an unversioned custom attestation type">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get attestation-type customTypeName

    ```
  </Accordion>

  <Accordion title="get version 1 of a custom attestation type">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get attestation-type customTypeName@v1
    ```
  </Accordion>
</AccordionGroup>


# kosli get control
Source: https://docs.kosli.com/client_reference/kosli_get_control

Get a Kosli control.

<Warning>
  This is a beta feature. Beta features provide early access to product
  functionality. These features may change between releases without warning, or
  can be removed in a future release. Please contact us to enable this feature
  for your organization.
</Warning>

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get control CONTROL-IDENTIFIER [flags]
```

Get a Kosli control.

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for control                                                                            |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="get a control">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get control yourControlIdentifier 
    ```
  </Accordion>
</AccordionGroup>


# kosli get default-org
Source: https://docs.kosli.com/client_reference/kosli_get_default-org

Get the default organization for the current user.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get default-org [flags]
```

Get the default organization for the current user.
The default organization is the one selected by default in the Kosli Web UI when you log in.

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for default-org                                                                        |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="get the default organization for the current user">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get default-org 
    ```
  </Accordion>
</AccordionGroup>


# kosli get environment
Source: https://docs.kosli.com/client_reference/kosli_get_environment

Get an environment's metadata.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get environment ENVIRONMENT-NAME [flags]
```

Get an environment's metadata.

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for environment                                                                        |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Example

To view a live example of 'kosli get environment' you can run the command below (for the [cyber-dojo](https://app.kosli.com/cyber-dojo) demo organization).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
# The API token below is read-only
export KOSLI_API_TOKEN=Pj_XT2deaVA6V1qrTlthuaWsmjVt4eaHQwqnwqjRO3A
kosli get environment aws-prod --output=json
```

<Accordion title="View example output">
  <div>
    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    {
      "org": "cyber-dojo",
      "name": "aws-prod",
      "type": "ECS",
      "description": "The ECS cluster for production cyber-dojo",
      "last_modified_at": 1788260398.5436597,
      "last_reported_at": 1788260398.5436597,
      "last_changed_at": 1788256325.6192138,
      "state": true,
      "include_scaling": false,
      "tags": {
        "url": "https://cyber-dojo.org/"
      },
      "policies": [
        "production-promotion",
        "provenance",
        "pull-request",
        "snyk-scan-aws-prod",
        "trail-compliance-aws-prod"
      ],
      "included_environments": null
    }
    ```
  </div>
</Accordion>


# kosli get flow
Source: https://docs.kosli.com/client_reference/kosli_get_flow

Get the metadata of a specific flow.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get flow FLOW-NAME [flags]
```

Get the metadata of a specific flow.

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for flow                                                                               |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Example

To view a live example of 'kosli get flow' you can run the command below (for the [cyber-dojo](https://app.kosli.com/cyber-dojo) demo organization).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
# The API token below is read-only
export KOSLI_API_TOKEN=Pj_XT2deaVA6V1qrTlthuaWsmjVt4eaHQwqnwqjRO3A
kosli get flow dashboard-ci --output=json
```

<Accordion title="View example output">
  <div>
    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    {
      "id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
      "name": "dashboard-ci",
      "description": "UX for a group practice dashboard",
      "visibility": "private",
      "org": "cyber-dojo",
      "template": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: dashboard\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n\n        - name: rubocop-lint\n          type: junit\n        - name: sonarcloud-scan\n          type: sonar\n        - name: unit-test\n          type: junit\n        - name: unit-test-coverage\n          type: generic\n",
      "repo_url": "https://github.com/cyber-dojo/dashboard",
      "tags": {
        "ci": "github",
        "repo_url": "https://github.com/cyber-dojo/dashboard",
        "kind": "build",
        "env": "aws-beta"
      }
    }
    ```
  </div>
</Accordion>


# kosli get policy
Source: https://docs.kosli.com/client_reference/kosli_get_policy

Get a policy's metadata.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get policy POLICY-NAME [flags]
```

Get a policy's metadata.

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for policy                                                                             |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |


# kosli get repo
Source: https://docs.kosli.com/client_reference/kosli_get_repo

Get a repo for an org.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get repo [REPO-NAME] [flags]
```

Get a repo for an org.
The repo is identified either by its name, specified as an argument
(e.g. "my-org/my-repo"), or unambiguously by its internal ID via --repo-id.
The output includes the repo's internal ID, which is the identifier used
to tag the repo (see: kosli tag).
Use --provider to disambiguate when multiple repos share the same name
across VCS providers.

## Flags

| Flag             | Type   | Description                                                                                                                                          |
| :--------------- | :----- | :--------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-h`, `--help`   | bool   | help for repo                                                                                                                                        |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")                                                          |
| `--provider`     | string | \[optional] The VCS provider of the repo (e.g. github, gitlab). Required when multiple repos share the same name across providers.                   |
| `--repo-id`      | string | \[optional] The repo's internal ID (as shown in the repo output). Identifies the repo unambiguously; cannot be combined with the REPO-NAME argument. |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="get a repo">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get repo my-org/my-repo 

    ```
  </Accordion>

  <Accordion title="get a repo whose name exists across multiple VCS providers">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get repo my-org/my-repo 
    	--provider github 

    ```
  </Accordion>

  <Accordion title="get a repo by its internal ID">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get repo --repo-id yourRepoID 
    ```
  </Accordion>
</AccordionGroup>


# kosli get service-account
Source: https://docs.kosli.com/client_reference/kosli_get_service-account

Get a service account's metadata.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get service-account SERVICE-ACCOUNT-NAME [flags]
```

Get a service account's metadata.

The metadata includes the name, description, privilege, and creation time. The
secret values of the account's API keys are never returned. Use `--output json`
to get the raw response for scripting.

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for service-account                                                                    |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="get the metadata of a service account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get service-account yourServiceAccountName 
    ```
  </Accordion>
</AccordionGroup>


# kosli get snapshot
Source: https://docs.kosli.com/client_reference/kosli_get_snapshot

Get a specified environment snapshot.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get snapshot ENVIRONMENT-NAME-OR-EXPRESSION [flags]
```

Get a specified environment snapshot.\
ENVIRONMENT-NAME-OR-EXPRESSION can be specified as follows:

* environmentName
  * the latest snapshot for environmentName, at the time of the request
  * e.g., **prod**
* environmentName#N
  * the Nth snapshot, counting from 1
  * e.g., **prod#42**
* environmentName\~N
  * the Nth snapshot behind the latest, at the time of the request
  * e.g., **prod\~5**
* environmentName@\{YYYY-MM-DDTHH:MM:SS}
  * the snapshot at specific moment in time in UTC
  * e.g., **prod@\{2023-10-02T12:00:00}**
* environmentName@\{N.`hours|days|weeks|months`.ago}
  * the snapshot at a time relative to the time of the request
  * e.g., **prod@\{2.hours.ago}**

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for snapshot                                                                           |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Example

To view a live example of 'kosli get snapshot' you can run the command below (for the [cyber-dojo](https://app.kosli.com/cyber-dojo) demo organization).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
# The API token below is read-only
export KOSLI_API_TOKEN=Pj_XT2deaVA6V1qrTlthuaWsmjVt4eaHQwqnwqjRO3A
kosli get snapshot aws-prod --output=json
```

<Accordion title="View example output">
  <div>
    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    {
      "index": 5309,
      "is_latest": true,
      "next_snapshot_timestamp": null,
      "artifact_compliance_count": {
        "true": 11,
        "false": 0,
        "null": 0
      },
      "timestamp": 1788256325.6192138,
      "type": "ECS",
      "compliant": true,
      "html_url": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309",
      "artifacts": [
        {
          "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:d64d2b1@sha256:c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
          "compliant": true,
          "deployments": [],
          "policy_decisions": [
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "pull_request",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "pull-request"
            },
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": true,
                      "exceptions": []
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0002"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "provenance"
            },
            {
              "policy_version": 4,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"snyk-aws-prod-per-artifact\""
                      },
                      "name": "snyk-container-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0022"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "snyk-scan-aws-prod"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"production-promotion\""
                      },
                      "name": "snyk-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "production-promotion"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": true,
                      "exceptions": [
                        {
                          "if": {
                            "text": "exists(flow.tags.env) and flow.tags.env != \"aws-prod\""
                          }
                        }
                      ]
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "creator-ci",
                        "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "trail-compliance-aws-prod"
            }
          ],
          "reasons_for_incompliance": [],
          "fingerprint": "c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
          "creationTimestamp": [
            1788256052
          ],
          "pods": null,
          "annotation": {
            "type": "updated-provenance",
            "was": 1,
            "now": 1
          },
          "flow_name": "creator-ci",
          "git_commit": "d64d2b11879179255f11dc991e81fbaf4a040264",
          "commit_url": "https://github.com/cyber-dojo/creator/commit/d64d2b11879179255f11dc991e81fbaf4a040264",
          "html_url": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=61384b36-4d32-43f2-8d5d-a72e2e7e",
          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/creator-ci",
          "deployment_diff": {
            "diff_url": "https://github.com/cyber-dojo/creator/compare/83357f112ef5c10b157cb84732c77965cc8ddc48...d64d2b11879179255f11dc991e81fbaf4a040264",
            "previous_git_commit": "83357f112ef5c10b157cb84732c77965cc8ddc48",
            "previous_fingerprint": "adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b",
            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:83357f1@sha256:adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b",
            "previous_artifact_compliance_state": "COMPLIANT",
            "previous_running": false,
            "previous_git_commit_url": "https://github.com/cyber-dojo/creator/commit/83357f112ef5c10b157cb84732c77965cc8ddc48",
            "previous_trail_name": "83357f112ef5c10b157cb84732c77965cc8ddc48",
            "previous_template_reference_name": "creator"
          },
          "commit_lead_time": 420668.0,
          "flows": [
            {
              "flow_name": "creator-ci",
              "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264",
              "template_reference_name": "creator",
              "git_commit": "d64d2b11879179255f11dc991e81fbaf4a040264",
              "commit_url": "https://github.com/cyber-dojo/creator/commit/d64d2b11879179255f11dc991e81fbaf4a040264",
              "git_commit_info": {
                "sha1": "d64d2b11879179255f11dc991e81fbaf4a040264",
                "message": "Merge update-base-image into main (#56)\n\n* Dockerfile - Automated base-image update\n\n* Make the test harness work on the simplecov the new base image carries\n\n  The automated base-image bump brings simplecov 0.21.2 -> 1.1.1, and\n  three things here were written against the older one. Only the first\n  fails the build; the other two announce themselves on stderr every run.\n\n  simplecov_json.rb reopened SimpleCov::Formatter::JSONFormatter to\n  redefine format. In 1.1.1 that class defines format itself, so ruby -w\n  reports the redefinition twice and test_log_warnings goes from 0 to 2.\n  It is now CoverageMetricsFormatter, named for the coverage_metrics.json\n  it writes, which is the same name runner gives the same job. It never\n  needed to be that class: what it produces is per-group totals, not the\n  per-file shape the shipped formatter writes, so it was only borrowing\n  the name to make itself win.\n\n  SimpleCov.add_group is deprecated in favour of group. The block\n  parameter goes from src to path while passing, since it is a source\n  file in both groups and src said otherwise in the test one.\n\n  # :nocov: is deprecated in favour of # simplecov:disable / :enable. The\n  pair wrapping id58_test_base.rb is the only one in the repo.\n\n  Coverage is unchanged: code.lines.total 526, test.lines.total 677,\n  nothing missed in either. coverage.rb already cleared filters, so the\n  test group survived 1.1.1 tightening the default test_frameworks skip\n  to an anchored regex, which is what caught start-points-base out.\n\n---------\n\nCo-authored-by: JonJagger <JonJagger@users.noreply.github.com>",
                "author": "Jon Jagger <jon@kosli.com>",
                "branch": "",
                "timestamp": 1787835384.0,
                "url": "https://github.com/cyber-dojo/creator/commit/d64d2b11879179255f11dc991e81fbaf4a040264"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=61384b36-4d32-43f2-8d5d-a72e2e7e",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/creator-ci",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/creator/compare/83357f112ef5c10b157cb84732c77965cc8ddc48...d64d2b11879179255f11dc991e81fbaf4a040264",
                "previous_git_commit": "83357f112ef5c10b157cb84732c77965cc8ddc48",
                "previous_fingerprint": "adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:83357f1@sha256:adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/creator/commit/83357f112ef5c10b157cb84732c77965cc8ddc48",
                "previous_trail_name": "83357f112ef5c10b157cb84732c77965cc8ddc48",
                "previous_template_reference_name": "creator"
              },
              "commit_lead_time": 420668.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-beta-per-artifact",
              "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
              "template_reference_name": "creator",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=5d73a605-4286-4a94-be8c-e2262a67",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_fingerprint": "adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:83357f1@sha256:adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_trail_name": "creator-adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b",
                "previous_template_reference_name": "creator"
              },
              "commit_lead_time": 594065.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "production-promotion",
              "trail_name": "promote-all-34",
              "template_reference_name": "creator",
              "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "git_commit_info": {
                "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "message": "Drop lone use of = separator on Kosli CLI boolean flag",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1785316994.0,
                "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=615d01cb-77c4-4429-9531-60460983",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_fingerprint": "adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:83357f1@sha256:adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_trail_name": "promote-all-33",
                "previous_template_reference_name": "creator"
              },
              "commit_lead_time": 2939058.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-prod-per-artifact",
              "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
              "template_reference_name": "creator",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=d4d51513-4c22-4eb3-b8b3-caa88478",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/7172cc22125f480a9f12127edb481a4d84aabea3...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "7172cc22125f480a9f12127edb481a4d84aabea3",
                "previous_fingerprint": "e8b5e25c5550658cdbd2b8339684b18bce86aaf6538611124ff62f2582c2e5b6",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:a288de5@sha256:e8b5e25c5550658cdbd2b8339684b18bce86aaf6538611124ff62f2582c2e5b6",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/7172cc22125f480a9f12127edb481a4d84aabea3",
                "previous_trail_name": "creator-e8b5e25c5550658cdbd2b8339684b18bce86aaf6538611124ff62f2582c2e5b6",
                "previous_template_reference_name": "creator"
              },
              "commit_lead_time": 594065.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            }
          ],
          "ecs_context": {
            "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/3497b80bc2ff41e792b5ca4a833882fc",
            "cluster_name": null,
            "service_name": null
          }
        },
        {
          "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:27b3504@sha256:1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
          "compliant": true,
          "deployments": [],
          "policy_decisions": [
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "pull_request",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "pull-request"
            },
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": true,
                      "exceptions": []
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0002"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "provenance"
            },
            {
              "policy_version": 4,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"snyk-aws-prod-per-artifact\""
                      },
                      "name": "snyk-container-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0022"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "snyk-scan-aws-prod"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"production-promotion\""
                      },
                      "name": "snyk-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "production-promotion"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": true,
                      "exceptions": [
                        {
                          "if": {
                            "text": "exists(flow.tags.env) and flow.tags.env != \"aws-prod\""
                          }
                        }
                      ]
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "nginx-ci",
                        "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "trail-compliance-aws-prod"
            }
          ],
          "reasons_for_incompliance": [],
          "fingerprint": "1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
          "creationTimestamp": [
            1788255750
          ],
          "pods": null,
          "annotation": {
            "type": "updated-provenance",
            "was": 1,
            "now": 1
          },
          "flow_name": "nginx-ci",
          "git_commit": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
          "commit_url": "https://github.com/cyber-dojo/nginx/commit/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
          "html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-ci/artifacts/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21?artifact_id=9045bb07-ea42-482f-99c3-4fe5b86f",
          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-ci",
          "deployment_diff": {
            "diff_url": "https://github.com/cyber-dojo/nginx/compare/fb791742054fa28dd89269aac8002ebfd7b3386e...27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
            "previous_git_commit": "fb791742054fa28dd89269aac8002ebfd7b3386e",
            "previous_fingerprint": "b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf",
            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:fb79174@sha256:b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf",
            "previous_artifact_compliance_state": "COMPLIANT",
            "previous_running": false,
            "previous_git_commit_url": "https://github.com/cyber-dojo/nginx/commit/fb791742054fa28dd89269aac8002ebfd7b3386e",
            "previous_trail_name": "fb791742054fa28dd89269aac8002ebfd7b3386e",
            "previous_template_reference_name": "nginx"
          },
          "commit_lead_time": 1790.0,
          "flows": [
            {
              "flow_name": "nginx-ci",
              "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
              "template_reference_name": "nginx",
              "git_commit": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
              "commit_url": "https://github.com/cyber-dojo/nginx/commit/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
              "git_commit_info": {
                "sha1": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                "message": "Merge pull request #169 from cyber-dojo/run-workflow-to-pick-up-fixes-to-snyk-vulns\n\nRun workflow to pick up fixes to new snyk vulns",
                "author": "Jon Jagger <jon@kosli.com>",
                "branch": "",
                "timestamp": 1788253960.0,
                "url": "https://github.com/cyber-dojo/nginx/commit/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-ci/artifacts/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21?artifact_id=9045bb07-ea42-482f-99c3-4fe5b86f",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-ci",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/nginx/compare/fb791742054fa28dd89269aac8002ebfd7b3386e...27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
                "previous_git_commit": "fb791742054fa28dd89269aac8002ebfd7b3386e",
                "previous_fingerprint": "b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:fb79174@sha256:b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/nginx/commit/fb791742054fa28dd89269aac8002ebfd7b3386e",
                "previous_trail_name": "fb791742054fa28dd89269aac8002ebfd7b3386e",
                "previous_template_reference_name": "nginx"
              },
              "commit_lead_time": 1790.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-beta-per-artifact",
              "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
              "template_reference_name": "nginx",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21?artifact_id=d14d27b1-2d09-43a9-bf35-f58f3164",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_fingerprint": "b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:fb79174@sha256:b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_trail_name": "nginx-b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf",
                "previous_template_reference_name": "nginx"
              },
              "commit_lead_time": 593763.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "production-promotion",
              "trail_name": "promote-all-34",
              "template_reference_name": "nginx",
              "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "git_commit_info": {
                "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "message": "Drop lone use of = separator on Kosli CLI boolean flag",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1785316994.0,
                "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21?artifact_id=1b78fe0b-61c8-4e00-bc5a-d54ae788",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_fingerprint": "b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:fb79174@sha256:b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_trail_name": "promote-all-33",
                "previous_template_reference_name": "nginx"
              },
              "commit_lead_time": 2938756.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-prod-per-artifact",
              "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
              "template_reference_name": "nginx",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21?artifact_id=c340a947-0136-4de1-acc8-2a89f741",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_fingerprint": "b7ff2cf22c934716a4280f0450ae52fe822cda7fce7fc5488bf62853860cddc8",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:7065268@sha256:b7ff2cf22c934716a4280f0450ae52fe822cda7fce7fc5488bf62853860cddc8",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_trail_name": "nginx-b7ff2cf22c934716a4280f0450ae52fe822cda7fce7fc5488bf62853860cddc8",
                "previous_template_reference_name": "nginx"
              },
              "commit_lead_time": 593763.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            }
          ],
          "ecs_context": {
            "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/675ca6104c294b369094b918f30ab6b9",
            "cluster_name": null,
            "service_name": null
          }
        },
        {
          "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:a357ebd@sha256:28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
          "compliant": true,
          "deployments": [],
          "policy_decisions": [
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "pull_request",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "pull-request"
            },
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": true,
                      "exceptions": []
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0002"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "provenance"
            },
            {
              "policy_version": 4,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"snyk-aws-prod-per-artifact\""
                      },
                      "name": "snyk-container-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0022"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "snyk-scan-aws-prod"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"production-promotion\""
                      },
                      "name": "snyk-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "production-promotion"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": true,
                      "exceptions": [
                        {
                          "if": {
                            "text": "exists(flow.tags.env) and flow.tags.env != \"aws-prod\""
                          }
                        }
                      ]
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "languages-start-points-ci",
                        "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "trail-compliance-aws-prod"
            }
          ],
          "reasons_for_incompliance": [],
          "fingerprint": "28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
          "creationTimestamp": [
            1788255750
          ],
          "pods": null,
          "annotation": {
            "type": "updated-provenance",
            "was": 1,
            "now": 1
          },
          "flow_name": "languages-start-points-ci",
          "git_commit": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
          "commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/a357ebd85acdd54968fa0192405aaf2e289d27c9",
          "html_url": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci/artifacts/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832?artifact_id=8e028a8d-a1f2-4732-8663-47012b29",
          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci",
          "deployment_diff": {
            "diff_url": "https://github.com/cyber-dojo/languages-start-points/compare/068b3424c7da843a4f2d428d2e4915f33efc4a02...a357ebd85acdd54968fa0192405aaf2e289d27c9",
            "previous_git_commit": "068b3424c7da843a4f2d428d2e4915f33efc4a02",
            "previous_fingerprint": "adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb",
            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:068b342@sha256:adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb",
            "previous_artifact_compliance_state": "COMPLIANT",
            "previous_running": false,
            "previous_git_commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/068b3424c7da843a4f2d428d2e4915f33efc4a02",
            "previous_trail_name": "068b3424c7da843a4f2d428d2e4915f33efc4a02",
            "previous_template_reference_name": "languages-start-points"
          },
          "commit_lead_time": 10038.0,
          "flows": [
            {
              "flow_name": "languages-start-points-ci",
              "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
              "template_reference_name": "languages-start-points",
              "git_commit": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
              "commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/a357ebd85acdd54968fa0192405aaf2e289d27c9",
              "git_commit_info": {
                "sha1": "a357ebd85acdd54968fa0192405aaf2e289d27c9",
                "message": "Merge pull request #252 from cyber-dojo/speed-updates-to-slowest-ltfs\n\nSpeed updates to the slowest LTFs",
                "author": "Jon Jagger <jon@kosli.com>",
                "branch": "",
                "timestamp": 1788245712.0,
                "url": "https://github.com/cyber-dojo/languages-start-points/commit/a357ebd85acdd54968fa0192405aaf2e289d27c9"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci/artifacts/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832?artifact_id=8e028a8d-a1f2-4732-8663-47012b29",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/languages-start-points/compare/068b3424c7da843a4f2d428d2e4915f33efc4a02...a357ebd85acdd54968fa0192405aaf2e289d27c9",
                "previous_git_commit": "068b3424c7da843a4f2d428d2e4915f33efc4a02",
                "previous_fingerprint": "adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:068b342@sha256:adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/068b3424c7da843a4f2d428d2e4915f33efc4a02",
                "previous_trail_name": "068b3424c7da843a4f2d428d2e4915f33efc4a02",
                "previous_template_reference_name": "languages-start-points"
              },
              "commit_lead_time": 10038.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-beta-per-artifact",
              "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
              "template_reference_name": "languages-start-points",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832?artifact_id=8b7fa132-7335-4301-a248-b13e4286",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_fingerprint": "adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:068b342@sha256:adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_trail_name": "languages-start-points-adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb",
                "previous_template_reference_name": "languages-start-points"
              },
              "commit_lead_time": 593763.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "production-promotion",
              "trail_name": "promote-all-34",
              "template_reference_name": "languages-start-points",
              "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "git_commit_info": {
                "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "message": "Drop lone use of = separator on Kosli CLI boolean flag",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1785316994.0,
                "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832?artifact_id=790a39b3-0c7c-4220-9d6b-63bff0f3",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_fingerprint": "adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:068b342@sha256:adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_trail_name": "promote-all-33",
                "previous_template_reference_name": "languages-start-points"
              },
              "commit_lead_time": 2938756.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-prod-per-artifact",
              "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
              "template_reference_name": "languages-start-points",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832?artifact_id=400979c3-f9c3-4652-8b12-2204fabb",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_fingerprint": "b2f51324efc1528e4dda57d235bdbc68d966e1ea23722d5d296f98eefbfc2676",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:7e86fed@sha256:b2f51324efc1528e4dda57d235bdbc68d966e1ea23722d5d296f98eefbfc2676",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_trail_name": "languages-start-points-b2f51324efc1528e4dda57d235bdbc68d966e1ea23722d5d296f98eefbfc2676",
                "previous_template_reference_name": "languages-start-points"
              },
              "commit_lead_time": 593763.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            }
          ],
          "ecs_context": {
            "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/cbb20953281f4b168eb98575717b01e7",
            "cluster_name": null,
            "service_name": null
          }
        },
        {
          "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:b12a5c9@sha256:34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
          "compliant": true,
          "deployments": [],
          "policy_decisions": [
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "pull_request",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "pull-request"
            },
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": true,
                      "exceptions": []
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0002"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "provenance"
            },
            {
              "policy_version": 4,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"snyk-aws-prod-per-artifact\""
                      },
                      "name": "snyk-container-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0022"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "snyk-scan-aws-prod"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"production-promotion\""
                      },
                      "name": "snyk-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "production-promotion"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": true,
                      "exceptions": [
                        {
                          "if": {
                            "text": "exists(flow.tags.env) and flow.tags.env != \"aws-prod\""
                          }
                        }
                      ]
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "custom-start-points-ci",
                        "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "trail-compliance-aws-prod"
            }
          ],
          "reasons_for_incompliance": [],
          "fingerprint": "34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
          "creationTimestamp": [
            1788255398
          ],
          "pods": null,
          "annotation": {
            "type": "updated-provenance",
            "was": 1,
            "now": 1
          },
          "flow_name": "custom-start-points-ci",
          "git_commit": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
          "commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/b12a5c9b17023462d13e81381a69c7ef05f84dc2",
          "html_url": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci/artifacts/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09?artifact_id=2aa23627-9e91-488e-b3ea-e4bf2e22",
          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci",
          "deployment_diff": {
            "diff_url": "https://github.com/cyber-dojo/custom-start-points/compare/790d86b66f4d86ab47f5c521daf5039dc8aeef4d...b12a5c9b17023462d13e81381a69c7ef05f84dc2",
            "previous_git_commit": "790d86b66f4d86ab47f5c521daf5039dc8aeef4d",
            "previous_fingerprint": "8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81",
            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:790d86b@sha256:8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81",
            "previous_artifact_compliance_state": "COMPLIANT",
            "previous_running": false,
            "previous_git_commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/790d86b66f4d86ab47f5c521daf5039dc8aeef4d",
            "previous_trail_name": "790d86b66f4d86ab47f5c521daf5039dc8aeef4d",
            "previous_template_reference_name": "custom-start-points"
          },
          "commit_lead_time": 416881.0,
          "flows": [
            {
              "flow_name": "custom-start-points-ci",
              "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
              "template_reference_name": "custom-start-points",
              "git_commit": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
              "commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/b12a5c9b17023462d13e81381a69c7ef05f84dc2",
              "git_commit_info": {
                "sha1": "b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                "message": "Merge pull request #143 from cyber-dojo/update-base-image-ce45d62\n\nMerge update-base-image into main",
                "author": "Jon Jagger <jon@kosli.com>",
                "branch": "",
                "timestamp": 1787838517.0,
                "url": "https://github.com/cyber-dojo/custom-start-points/commit/b12a5c9b17023462d13e81381a69c7ef05f84dc2"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci/artifacts/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09?artifact_id=2aa23627-9e91-488e-b3ea-e4bf2e22",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/custom-start-points/compare/790d86b66f4d86ab47f5c521daf5039dc8aeef4d...b12a5c9b17023462d13e81381a69c7ef05f84dc2",
                "previous_git_commit": "790d86b66f4d86ab47f5c521daf5039dc8aeef4d",
                "previous_fingerprint": "8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:790d86b@sha256:8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/790d86b66f4d86ab47f5c521daf5039dc8aeef4d",
                "previous_trail_name": "790d86b66f4d86ab47f5c521daf5039dc8aeef4d",
                "previous_template_reference_name": "custom-start-points"
              },
              "commit_lead_time": 416881.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-beta-per-artifact",
              "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
              "template_reference_name": "custom-start-points",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09?artifact_id=b5dae6e2-12e1-47bc-a361-ead8aa3f",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_fingerprint": "8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:790d86b@sha256:8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_trail_name": "custom-start-points-8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81",
                "previous_template_reference_name": "custom-start-points"
              },
              "commit_lead_time": 593411.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "production-promotion",
              "trail_name": "promote-all-34",
              "template_reference_name": "custom-start-points",
              "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "git_commit_info": {
                "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "message": "Drop lone use of = separator on Kosli CLI boolean flag",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1785316994.0,
                "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09?artifact_id=63e61c31-696e-4465-9145-2c51f6d4",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/81c216a55b2cb1787645e699ceaceca868cad253...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_git_commit": "81c216a55b2cb1787645e699ceaceca868cad253",
                "previous_fingerprint": "8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:790d86b@sha256:8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/81c216a55b2cb1787645e699ceaceca868cad253",
                "previous_trail_name": "promote-all-31",
                "previous_template_reference_name": "custom-start-points"
              },
              "commit_lead_time": 2938404.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-prod-per-artifact",
              "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
              "template_reference_name": "custom-start-points",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09?artifact_id=ff77dce2-dd84-40ff-b134-d21758f5",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_fingerprint": "b4448ca68a0926e4a7a800f5b101b63e9c2f38e1caaebb7e929d992763570928",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:6b5c159@sha256:b4448ca68a0926e4a7a800f5b101b63e9c2f38e1caaebb7e929d992763570928",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_trail_name": "custom-start-points-b4448ca68a0926e4a7a800f5b101b63e9c2f38e1caaebb7e929d992763570928",
                "previous_template_reference_name": "custom-start-points"
              },
              "commit_lead_time": 593411.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            }
          ],
          "ecs_context": {
            "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/b7894ad2c80e4774adbeab8165291101",
            "cluster_name": null,
            "service_name": null
          }
        },
        {
          "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:84e986a@sha256:06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
          "compliant": true,
          "deployments": [],
          "policy_decisions": [
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "pull_request",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "pull-request"
            },
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": true,
                      "exceptions": []
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0002"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "provenance"
            },
            {
              "policy_version": 4,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"snyk-aws-prod-per-artifact\""
                      },
                      "name": "snyk-container-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0022"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "snyk-scan-aws-prod"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"production-promotion\""
                      },
                      "name": "snyk-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "production-promotion"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": true,
                      "exceptions": [
                        {
                          "if": {
                            "text": "exists(flow.tags.env) and flow.tags.env != \"aws-prod\""
                          }
                        }
                      ]
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "saver-ci",
                        "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "trail-compliance-aws-prod"
            }
          ],
          "reasons_for_incompliance": [],
          "fingerprint": "06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
          "creationTimestamp": [
            1788255396
          ],
          "pods": null,
          "annotation": {
            "type": "updated-provenance",
            "was": 1,
            "now": 1
          },
          "flow_name": "saver-ci",
          "git_commit": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
          "commit_url": "https://github.com/cyber-dojo/saver/commit/84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
          "html_url": "https://app.kosli.com/cyber-dojo/flows/saver-ci/artifacts/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f?artifact_id=a599cb04-5965-46a6-a774-24dc6341",
          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/saver-ci",
          "deployment_diff": {
            "diff_url": "https://github.com/cyber-dojo/saver/compare/36f0420f728fe61e44a3ab0043cf9a3d70863cad...84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
            "previous_git_commit": "36f0420f728fe61e44a3ab0043cf9a3d70863cad",
            "previous_fingerprint": "2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a",
            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:36f0420@sha256:2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a",
            "previous_artifact_compliance_state": "COMPLIANT",
            "previous_running": false,
            "previous_git_commit_url": "https://github.com/cyber-dojo/saver/commit/36f0420f728fe61e44a3ab0043cf9a3d70863cad",
            "previous_trail_name": "36f0420f728fe61e44a3ab0043cf9a3d70863cad",
            "previous_template_reference_name": "saver"
          },
          "commit_lead_time": 3241.0,
          "flows": [
            {
              "flow_name": "saver-ci",
              "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
              "template_reference_name": "saver",
              "git_commit": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
              "commit_url": "https://github.com/cyber-dojo/saver/commit/84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
              "git_commit_info": {
                "sha1": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                "message": "Run workflow to pick up fixes to expat vulns (#443)",
                "author": "Jon Jagger <jon@kosli.com>",
                "branch": "",
                "timestamp": 1788252155.0,
                "url": "https://github.com/cyber-dojo/saver/commit/84e986ad70d32e9be362d5bd9ce7c7af94f6eaab"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/saver-ci/artifacts/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f?artifact_id=a599cb04-5965-46a6-a774-24dc6341",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/saver-ci",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/saver/compare/36f0420f728fe61e44a3ab0043cf9a3d70863cad...84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
                "previous_git_commit": "36f0420f728fe61e44a3ab0043cf9a3d70863cad",
                "previous_fingerprint": "2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:36f0420@sha256:2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/saver/commit/36f0420f728fe61e44a3ab0043cf9a3d70863cad",
                "previous_trail_name": "36f0420f728fe61e44a3ab0043cf9a3d70863cad",
                "previous_template_reference_name": "saver"
              },
              "commit_lead_time": 3241.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-beta-per-artifact",
              "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
              "template_reference_name": "saver",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f?artifact_id=954a634e-bcc4-4aeb-b74a-3228e48f",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_fingerprint": "2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:36f0420@sha256:2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_trail_name": "saver-2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a",
                "previous_template_reference_name": "saver"
              },
              "commit_lead_time": 593409.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "production-promotion",
              "trail_name": "promote-all-34",
              "template_reference_name": "saver",
              "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "git_commit_info": {
                "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "message": "Drop lone use of = separator on Kosli CLI boolean flag",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1785316994.0,
                "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f?artifact_id=ad8076c0-8b7e-47ac-b82a-2f2bb220",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_fingerprint": "2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:36f0420@sha256:2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_trail_name": "promote-all-33",
                "previous_template_reference_name": "saver"
              },
              "commit_lead_time": 2938402.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-prod-per-artifact",
              "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
              "template_reference_name": "saver",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f?artifact_id=91be21a4-68bf-4710-9f74-0c7a5ac5",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_fingerprint": "f5909cc8dd53b2105953d1a72cd5d6181367d3588964aa01a04c056205a5d419",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:8c84fac@sha256:f5909cc8dd53b2105953d1a72cd5d6181367d3588964aa01a04c056205a5d419",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_trail_name": "saver-f5909cc8dd53b2105953d1a72cd5d6181367d3588964aa01a04c056205a5d419",
                "previous_template_reference_name": "saver"
              },
              "commit_lead_time": 593409.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            }
          ],
          "ecs_context": {
            "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/490f2bdcf1a2453db2a23395e26d2392",
            "cluster_name": null,
            "service_name": null
          }
        },
        {
          "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:f22a30e@sha256:41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
          "compliant": true,
          "deployments": [],
          "policy_decisions": [
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "pull_request",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "pull-request"
            },
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": true,
                      "exceptions": []
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0002"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "provenance"
            },
            {
              "policy_version": 4,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"snyk-aws-prod-per-artifact\""
                      },
                      "name": "snyk-container-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0022"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "snyk-scan-aws-prod"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"production-promotion\""
                      },
                      "name": "snyk-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "production-promotion"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": true,
                      "exceptions": [
                        {
                          "if": {
                            "text": "exists(flow.tags.env) and flow.tags.env != \"aws-prod\""
                          }
                        }
                      ]
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "exercises-start-points-ci",
                        "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "trail-compliance-aws-prod"
            }
          ],
          "reasons_for_incompliance": [],
          "fingerprint": "41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
          "creationTimestamp": [
            1788255396
          ],
          "pods": null,
          "annotation": {
            "type": "updated-provenance",
            "was": 1,
            "now": 1
          },
          "flow_name": "exercises-start-points-ci",
          "git_commit": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
          "commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
          "html_url": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci/artifacts/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6?artifact_id=aa4300d4-b690-4d71-9596-6af987e1",
          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci",
          "deployment_diff": {
            "diff_url": "https://github.com/cyber-dojo/exercises-start-points/compare/258b6d07d2b28ad5cb2ce6d29934997f72380f1a...f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
            "previous_git_commit": "258b6d07d2b28ad5cb2ce6d29934997f72380f1a",
            "previous_fingerprint": "c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea",
            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:258b6d0@sha256:c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea",
            "previous_artifact_compliance_state": "COMPLIANT",
            "previous_running": false,
            "previous_git_commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/258b6d07d2b28ad5cb2ce6d29934997f72380f1a",
            "previous_trail_name": "258b6d07d2b28ad5cb2ce6d29934997f72380f1a",
            "previous_template_reference_name": "exercises-start-points"
          },
          "commit_lead_time": 416885.0,
          "flows": [
            {
              "flow_name": "exercises-start-points-ci",
              "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
              "template_reference_name": "exercises-start-points",
              "git_commit": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
              "commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
              "git_commit_info": {
                "sha1": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                "message": "Merge pull request #149 from cyber-dojo/update-base-image-ce45d62\n\nMerge update-base-image into main",
                "author": "Jon Jagger <jon@kosli.com>",
                "branch": "",
                "timestamp": 1787838511.0,
                "url": "https://github.com/cyber-dojo/exercises-start-points/commit/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci/artifacts/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6?artifact_id=aa4300d4-b690-4d71-9596-6af987e1",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/exercises-start-points/compare/258b6d07d2b28ad5cb2ce6d29934997f72380f1a...f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
                "previous_git_commit": "258b6d07d2b28ad5cb2ce6d29934997f72380f1a",
                "previous_fingerprint": "c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:258b6d0@sha256:c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/258b6d07d2b28ad5cb2ce6d29934997f72380f1a",
                "previous_trail_name": "258b6d07d2b28ad5cb2ce6d29934997f72380f1a",
                "previous_template_reference_name": "exercises-start-points"
              },
              "commit_lead_time": 416885.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-beta-per-artifact",
              "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
              "template_reference_name": "exercises-start-points",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6?artifact_id=f0d94332-8b7c-4437-adf8-dc070a8e",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_fingerprint": "c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:258b6d0@sha256:c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_trail_name": "exercises-start-points-c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea",
                "previous_template_reference_name": "exercises-start-points"
              },
              "commit_lead_time": 593409.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "production-promotion",
              "trail_name": "promote-all-34",
              "template_reference_name": "exercises-start-points",
              "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "git_commit_info": {
                "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "message": "Drop lone use of = separator on Kosli CLI boolean flag",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1785316994.0,
                "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6?artifact_id=edc896a3-98a0-4cb0-8147-49fd6952",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/81c216a55b2cb1787645e699ceaceca868cad253...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_git_commit": "81c216a55b2cb1787645e699ceaceca868cad253",
                "previous_fingerprint": "c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:258b6d0@sha256:c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/81c216a55b2cb1787645e699ceaceca868cad253",
                "previous_trail_name": "promote-all-31",
                "previous_template_reference_name": "exercises-start-points"
              },
              "commit_lead_time": 2938402.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-prod-per-artifact",
              "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
              "template_reference_name": "exercises-start-points",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6?artifact_id=601099dd-9069-4756-8c33-35cf65e1",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_fingerprint": "f00aa234bebafb1980dced29626750f84a6fe6c9c50f6a90167e4d8e6511a8a8",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:b8e5cbf@sha256:f00aa234bebafb1980dced29626750f84a6fe6c9c50f6a90167e4d8e6511a8a8",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_trail_name": "exercises-start-points-f00aa234bebafb1980dced29626750f84a6fe6c9c50f6a90167e4d8e6511a8a8",
                "previous_template_reference_name": "exercises-start-points"
              },
              "commit_lead_time": 593409.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            }
          ],
          "ecs_context": {
            "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/ca7755573c354bb191fc03f5496f0e7a",
            "cluster_name": null,
            "service_name": null
          }
        },
        {
          "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:90c8d98@sha256:6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
          "compliant": true,
          "deployments": [],
          "policy_decisions": [
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "pull_request",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "pull-request"
            },
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": true,
                      "exceptions": []
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0002"
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "provenance"
            },
            {
              "policy_version": 4,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"snyk-aws-prod-per-artifact\""
                      },
                      "name": "snyk-container-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0022"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "snyk-scan-aws-prod"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"production-promotion\""
                      },
                      "name": "snyk-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "production-promotion"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": true,
                      "exceptions": [
                        {
                          "if": {
                            "text": "exists(flow.tags.env) and flow.tags.env != \"aws-prod\""
                          }
                        }
                      ]
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "spooler-ci",
                        "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "trail-compliance-aws-prod"
            }
          ],
          "reasons_for_incompliance": [],
          "fingerprint": "6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
          "creationTimestamp": [
            1788255396
          ],
          "pods": null,
          "annotation": {
            "type": "updated-provenance",
            "was": 1,
            "now": 1
          },
          "flow_name": "spooler-ci",
          "git_commit": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
          "commit_url": "https://github.com/cyber-dojo/spooler/commit/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
          "html_url": "https://app.kosli.com/cyber-dojo/flows/spooler-ci/artifacts/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd?artifact_id=6df79438-91a2-4c2b-a945-52fb5218",
          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/spooler-ci",
          "deployment_diff": {
            "diff_url": "https://github.com/cyber-dojo/spooler/compare/dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb...90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
            "previous_git_commit": "dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb",
            "previous_fingerprint": "ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0",
            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:dc7dea2@sha256:ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0",
            "previous_artifact_compliance_state": "COMPLIANT",
            "previous_running": false,
            "previous_git_commit_url": "https://github.com/cyber-dojo/spooler/commit/dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb",
            "previous_trail_name": "dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb",
            "previous_template_reference_name": "spooler"
          },
          "commit_lead_time": 352135.0,
          "flows": [
            {
              "flow_name": "spooler-ci",
              "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
              "template_reference_name": "spooler",
              "git_commit": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
              "commit_url": "https://github.com/cyber-dojo/spooler/commit/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
              "git_commit_info": {
                "sha1": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                "message": "Merge pull request #18 from cyber-dojo/give-each-saver-forward-its-own-connection\n\nGive each saver forward its own http connection",
                "author": "Jon Jagger <jon@kosli.com>",
                "branch": "",
                "timestamp": 1787903261.0,
                "url": "https://github.com/cyber-dojo/spooler/commit/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/spooler-ci/artifacts/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd?artifact_id=6df79438-91a2-4c2b-a945-52fb5218",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/spooler-ci",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/spooler/compare/dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb...90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
                "previous_git_commit": "dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb",
                "previous_fingerprint": "ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:dc7dea2@sha256:ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/spooler/commit/dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb",
                "previous_trail_name": "dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb",
                "previous_template_reference_name": "spooler"
              },
              "commit_lead_time": 352135.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-beta-per-artifact",
              "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
              "template_reference_name": "spooler",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd?artifact_id=83b85760-e1f3-476b-9925-19541dee",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/10203d5d23f93844726f204390cf3d5ca8d5c913...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "10203d5d23f93844726f204390cf3d5ca8d5c913",
                "previous_fingerprint": "ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:dc7dea2@sha256:ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/10203d5d23f93844726f204390cf3d5ca8d5c913",
                "previous_trail_name": "spooler-ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0",
                "previous_template_reference_name": "spooler"
              },
              "commit_lead_time": 593409.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "production-promotion",
              "trail_name": "promote-all-34",
              "template_reference_name": "spooler",
              "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "git_commit_info": {
                "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "message": "Drop lone use of = separator on Kosli CLI boolean flag",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1785316994.0,
                "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd?artifact_id=fdd39323-ac61-4894-ae67-fc003bac",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_fingerprint": "ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:dc7dea2@sha256:ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_trail_name": "promote-all-33",
                "previous_template_reference_name": "spooler"
              },
              "commit_lead_time": 2938402.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-prod-per-artifact",
              "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
              "template_reference_name": "spooler",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd?artifact_id=24059058-ed02-4061-a4d1-b9a66269",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
              "deployment_diff": null,
              "commit_lead_time": 593409.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            }
          ],
          "ecs_context": {
            "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/61175d755bb64c5bba7130b854325414",
            "cluster_name": null,
            "service_name": null
          }
        },
        {
          "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:ff9f292@sha256:2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
          "compliant": true,
          "deployments": [],
          "policy_decisions": [
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "pull_request",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "pull-request"
            },
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": true,
                      "exceptions": []
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0002"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "provenance"
            },
            {
              "policy_version": 4,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"snyk-aws-prod-per-artifact\""
                      },
                      "name": "snyk-container-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0022"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "snyk-scan-aws-prod"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"production-promotion\""
                      },
                      "name": "snyk-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "production-promotion"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": true,
                      "exceptions": [
                        {
                          "if": {
                            "text": "exists(flow.tags.env) and flow.tags.env != \"aws-prod\""
                          }
                        }
                      ]
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "dashboard-ci",
                        "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "trail-compliance-aws-prod"
            }
          ],
          "reasons_for_incompliance": [],
          "fingerprint": "2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
          "creationTimestamp": [
            1788255387
          ],
          "pods": null,
          "annotation": {
            "type": "updated-provenance",
            "was": 1,
            "now": 1
          },
          "flow_name": "dashboard-ci",
          "git_commit": "ff9f292e809801d35246183988b7812826bc2760",
          "commit_url": "https://github.com/cyber-dojo/dashboard/commit/ff9f292e809801d35246183988b7812826bc2760",
          "html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/artifacts/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f?artifact_id=aa6c0c1d-2d5d-4c98-9f9d-1160dd2f",
          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci",
          "deployment_diff": {
            "diff_url": "https://github.com/cyber-dojo/dashboard/compare/2b300f450f72006f6a9000aaf9cd04485f1e8095...ff9f292e809801d35246183988b7812826bc2760",
            "previous_git_commit": "2b300f450f72006f6a9000aaf9cd04485f1e8095",
            "previous_fingerprint": "1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5",
            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:2b300f4@sha256:1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5",
            "previous_artifact_compliance_state": "COMPLIANT",
            "previous_running": false,
            "previous_git_commit_url": "https://github.com/cyber-dojo/dashboard/commit/2b300f450f72006f6a9000aaf9cd04485f1e8095",
            "previous_trail_name": "2b300f450f72006f6a9000aaf9cd04485f1e8095",
            "previous_template_reference_name": "dashboard"
          },
          "commit_lead_time": 413493.0,
          "flows": [
            {
              "flow_name": "dashboard-ci",
              "trail_name": "ff9f292e809801d35246183988b7812826bc2760",
              "template_reference_name": "dashboard",
              "git_commit": "ff9f292e809801d35246183988b7812826bc2760",
              "commit_url": "https://github.com/cyber-dojo/dashboard/commit/ff9f292e809801d35246183988b7812826bc2760",
              "git_commit_info": {
                "sha1": "ff9f292e809801d35246183988b7812826bc2760",
                "message": "Use the simplecov 1.x spellings (#436)\n\n* Use the simplecov 1.x spellings\n\n  The base image now carries simplecov 1.1.1 where it carried 0.21.2.\n  Four spellings are deprecated there, each announcing itself on stderr on\n  every run:\n\n    add_group  -> group\n    add_filter -> skip\n    # :nocov:  -> # simplecov:disable / # simplecov:enable\n\n  and the formatter reopened SimpleCov::Formatter::JSONFormatter to\n  redefine format, which in 1.1.1 makes ruby -w report the redefinition.\n  It is now CoverageMetricsFormatter, named for the coverage_metrics.json\n  it writes. It never needed to be that class: what it produces is\n  per-group totals, not the per-file shape the shipped formatter writes,\n  so it was only borrowing the name to make itself win.\n\n  The three :nocov: pairs are all in source, guarding the post methods\n  that only the fixture scripts in test/scripts reach. The comment in\n  create_v2_dashboard.rb naming those markers is renamed with them, so it\n  still points at something that exists.\n\n  source/client/Dockerfile was pinned to cyberdojo/sinatra-base:759c4e9 on\n  Docker Hub, while everything else moved to ghcr.io. The automated\n  base-image PR only rewrites the Dockerfile at the repo root, so that pin\n  had gone unbumped long enough to be several ruby versions behind. It now\n  names the same image as the root.\n\n  That bump is unverified. The client tests cannot run: the client asks\n  for hostname 'server' (source/client/code/external_dashboard.rb) and\n  docker-compose.yml calls that service 'dashboard', so its healthcheck\n  never resolves. Nothing noticed because no workflow runs them and the\n  Makefile has no client target. Left as found, since dashboard is due to\n  be merged into web.\n\n  The group block parameter goes from the to path while passing.\n\n  Coverage is unchanged: test.lines.total 644, code.lines.total 460,\n  nothing missed in either.\n\n* Keep the simplecov markers inside the line length, and let rubocop cache\n\n  simplecov:disable is seven characters longer than the :nocov: it\n  replaced, which took three comment lines past 80 and failed the lint the\n  previous commit had no reason to run. The prose those markers carried\n  moves to its own line above them, so the marker line is only a marker\n  and its length no longer depends on what is being explained.\n\n  Separately, rubocop_lint.sh runs the container as the invoking uid,\n  which has no entry in the container's /etc/passwd. HOME falls back to /,\n  rubocop cannot create /.cache, and it says so once per file inspected -\n  35 lines of it here, and enough to bury the offences it is reporting.\n  Naming a writable HOME lets it cache and say nothing.\n\n  Neither changes what is inspected: 35 files, no offences, and the tests\n  still report 50 runs with coverage on its limits at 644 and 460.",
                "author": "Jon Jagger <jon@kosli.com>",
                "branch": "",
                "timestamp": 1787841894.0,
                "url": "https://github.com/cyber-dojo/dashboard/commit/ff9f292e809801d35246183988b7812826bc2760"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/artifacts/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f?artifact_id=aa6c0c1d-2d5d-4c98-9f9d-1160dd2f",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/dashboard/compare/2b300f450f72006f6a9000aaf9cd04485f1e8095...ff9f292e809801d35246183988b7812826bc2760",
                "previous_git_commit": "2b300f450f72006f6a9000aaf9cd04485f1e8095",
                "previous_fingerprint": "1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:2b300f4@sha256:1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/dashboard/commit/2b300f450f72006f6a9000aaf9cd04485f1e8095",
                "previous_trail_name": "2b300f450f72006f6a9000aaf9cd04485f1e8095",
                "previous_template_reference_name": "dashboard"
              },
              "commit_lead_time": 413493.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-beta-per-artifact",
              "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
              "template_reference_name": "dashboard",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f?artifact_id=07236a18-f9e6-440c-8163-89b30638",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_fingerprint": "1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:2b300f4@sha256:1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_trail_name": "dashboard-1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5",
                "previous_template_reference_name": "dashboard"
              },
              "commit_lead_time": 593400.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "production-promotion",
              "trail_name": "promote-all-34",
              "template_reference_name": "dashboard",
              "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "git_commit_info": {
                "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "message": "Drop lone use of = separator on Kosli CLI boolean flag",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1785316994.0,
                "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f?artifact_id=7d30bba6-9d58-403b-b6d8-efe3ebad",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_fingerprint": "1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:2b300f4@sha256:1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_trail_name": "promote-all-33",
                "previous_template_reference_name": "dashboard"
              },
              "commit_lead_time": 2938393.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-prod-per-artifact",
              "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
              "template_reference_name": "dashboard",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f?artifact_id=95ee902d-ed5f-49ac-a772-a1ea0d78",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_fingerprint": "45513c642ba191052bde056d56eeba8b06b0346eb444ec0008bd59bc0581bb8c",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:87f560f@sha256:45513c642ba191052bde056d56eeba8b06b0346eb444ec0008bd59bc0581bb8c",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_trail_name": "dashboard-45513c642ba191052bde056d56eeba8b06b0346eb444ec0008bd59bc0581bb8c",
                "previous_template_reference_name": "dashboard"
              },
              "commit_lead_time": 593400.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            }
          ],
          "ecs_context": {
            "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/f61e1822d26f4aa0a417417c3436c569",
            "cluster_name": null,
            "service_name": null
          }
        },
        {
          "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:cbe481c@sha256:36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
          "compliant": true,
          "deployments": [],
          "policy_decisions": [
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "pull_request",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "pull-request"
            },
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": true,
                      "exceptions": []
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0002"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "provenance"
            },
            {
              "policy_version": 4,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"snyk-aws-prod-per-artifact\""
                      },
                      "name": "snyk-container-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0022"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "snyk-scan-aws-prod"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"production-promotion\""
                      },
                      "name": "snyk-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "production-promotion"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": true,
                      "exceptions": [
                        {
                          "if": {
                            "text": "exists(flow.tags.env) and flow.tags.env != \"aws-prod\""
                          }
                        }
                      ]
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "web-ci",
                        "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promotion-one-161",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "trail-compliance-aws-prod"
            }
          ],
          "reasons_for_incompliance": [],
          "fingerprint": "36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
          "creationTimestamp": [
            1788074885,
            1788074889,
            1788074889
          ],
          "pods": null,
          "annotation": {
            "type": "updated-provenance",
            "was": 3,
            "now": 3
          },
          "flow_name": "web-ci",
          "git_commit": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
          "commit_url": "https://github.com/cyber-dojo/web/commit/cbe481c4b842f897e4e9e411cd78461a3a12a334",
          "html_url": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc?artifact_id=41957e62-eaad-48d2-af40-46879efb",
          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/web-ci",
          "deployment_diff": {
            "diff_url": "https://github.com/cyber-dojo/web/compare/5e4b9873df93525c041c386c06e0ab8fc36b6f33...cbe481c4b842f897e4e9e411cd78461a3a12a334",
            "previous_git_commit": "5e4b9873df93525c041c386c06e0ab8fc36b6f33",
            "previous_fingerprint": "6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd",
            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:5e4b987@sha256:6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd",
            "previous_artifact_compliance_state": "COMPLIANT",
            "previous_running": false,
            "previous_git_commit_url": "https://github.com/cyber-dojo/web/commit/5e4b9873df93525c041c386c06e0ab8fc36b6f33",
            "previous_trail_name": "5e4b9873df93525c041c386c06e0ab8fc36b6f33",
            "previous_template_reference_name": "web"
          },
          "commit_lead_time": 169904.0,
          "flows": [
            {
              "flow_name": "web-ci",
              "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
              "template_reference_name": "web",
              "git_commit": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
              "commit_url": "https://github.com/cyber-dojo/web/commit/cbe481c4b842f897e4e9e411cd78461a3a12a334",
              "git_commit_info": {
                "sha1": "cbe481c4b842f897e4e9e411cd78461a3a12a334",
                "message": "Match the siblings on test-output buffering and frozen-string comments (#424)\n\nThe tee in the server test run makes ruby block-buffer stdout, so the\n  progress dots only appeared once the whole run had finished. saver sets\n  $stdout.sync in its own -e script for exactly this reason; web now does\n  too.\n\n  Every repo already freezes literals globally via RUBYOPT in up.sh, so a\n  per-file magic comment buys nothing. runner, creator and differ exclude\n  source/ from the cop, while web grandfathered each file in the todo\n  instead, which is why the cop fired on the one newly added file.\n  Excluding source/ matches them and leaves the todo holding only the bin/\n  script that RUBYOPT does not reach.",
                "author": "Jon Jagger <jon@kosli.com>",
                "branch": "",
                "timestamp": 1787904981.0,
                "url": "https://github.com/cyber-dojo/web/commit/cbe481c4b842f897e4e9e411cd78461a3a12a334"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc?artifact_id=41957e62-eaad-48d2-af40-46879efb",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/web-ci",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/web/compare/5e4b9873df93525c041c386c06e0ab8fc36b6f33...cbe481c4b842f897e4e9e411cd78461a3a12a334",
                "previous_git_commit": "5e4b9873df93525c041c386c06e0ab8fc36b6f33",
                "previous_fingerprint": "6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:5e4b987@sha256:6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/web/commit/5e4b9873df93525c041c386c06e0ab8fc36b6f33",
                "previous_trail_name": "5e4b9873df93525c041c386c06e0ab8fc36b6f33",
                "previous_template_reference_name": "web"
              },
              "commit_lead_time": 169904.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "production-promotion",
              "trail_name": "promotion-one-161",
              "template_reference_name": "web",
              "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "git_commit_info": {
                "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "message": "Drop lone use of = separator on Kosli CLI boolean flag",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1785316994.0,
                "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc?artifact_id=3e754e79-8e4c-486a-ad94-0b183d32",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_fingerprint": "6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:5e4b987@sha256:6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_trail_name": "promote-all-33",
                "previous_template_reference_name": "web"
              },
              "commit_lead_time": 2757891.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-beta-per-artifact",
              "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
              "template_reference_name": "web",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc?artifact_id=14a0333a-7e59-454f-bcfa-f4c2e34b",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_fingerprint": "6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:5e4b987@sha256:6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_trail_name": "web-6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd",
                "previous_template_reference_name": "web"
              },
              "commit_lead_time": 412898.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-prod-per-artifact",
              "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
              "template_reference_name": "web",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc?artifact_id=d7711381-757a-437c-9c77-55bcfd5f",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_fingerprint": "29c69c2f30f261a26fff4793fd8ae44b9081def1d4bcaaa27b0fef0501d949e4",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:f66cc5c@sha256:29c69c2f30f261a26fff4793fd8ae44b9081def1d4bcaaa27b0fef0501d949e4",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_trail_name": "web-29c69c2f30f261a26fff4793fd8ae44b9081def1d4bcaaa27b0fef0501d949e4",
                "previous_template_reference_name": "web"
              },
              "commit_lead_time": 412898.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            }
          ],
          "ecs_context": {
            "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/d68ae20a684745c6ba576ab68a51dd25",
            "cluster_name": null,
            "service_name": null
          }
        },
        {
          "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:ca65b67@sha256:a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
          "compliant": true,
          "deployments": [],
          "policy_decisions": [
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "pull_request",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "pull-request"
            },
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": true,
                      "exceptions": []
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0002"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "provenance"
            },
            {
              "policy_version": 4,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"snyk-aws-prod-per-artifact\""
                      },
                      "name": "snyk-container-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0022"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "snyk-scan-aws-prod"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"production-promotion\""
                      },
                      "name": "snyk-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "production-promotion"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": true,
                      "exceptions": [
                        {
                          "if": {
                            "text": "exists(flow.tags.env) and flow.tags.env != \"aws-prod\""
                          }
                        }
                      ]
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "runner-ci",
                        "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "trail-compliance-aws-prod"
            }
          ],
          "reasons_for_incompliance": [],
          "fingerprint": "a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
          "creationTimestamp": [
            1788255749,
            1788255749,
            1788255844
          ],
          "pods": null,
          "annotation": {
            "type": "unchanged",
            "was": 3,
            "now": 3
          },
          "flow_name": "runner-ci",
          "git_commit": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
          "commit_url": "https://github.com/cyber-dojo/runner/commit/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
          "html_url": "https://app.kosli.com/cyber-dojo/flows/runner-ci/artifacts/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638?artifact_id=3b03ceaf-96a6-4afa-8aa2-179e5fe9",
          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/runner-ci",
          "deployment_diff": {
            "diff_url": "https://github.com/cyber-dojo/runner/compare/976b63e8001ec7441ebc7737ca69f620d47e7ffe...ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
            "previous_git_commit": "976b63e8001ec7441ebc7737ca69f620d47e7ffe",
            "previous_fingerprint": "01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9",
            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:976b63e@sha256:01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9",
            "previous_artifact_compliance_state": "COMPLIANT",
            "previous_running": false,
            "previous_git_commit_url": "https://github.com/cyber-dojo/runner/commit/976b63e8001ec7441ebc7737ca69f620d47e7ffe",
            "previous_trail_name": "976b63e8001ec7441ebc7737ca69f620d47e7ffe",
            "previous_template_reference_name": "runner"
          },
          "commit_lead_time": 92169.0,
          "flows": [
            {
              "flow_name": "runner-ci",
              "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
              "template_reference_name": "runner",
              "git_commit": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
              "commit_url": "https://github.com/cyber-dojo/runner/commit/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
              "git_commit_info": {
                "sha1": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                "message": "Keep the containers stderr empty (#306)\n\n* Run rm and truncate only when the walk finds files\n\n  xargs runs its command once even when its input is empty, on GNU\n  findutils and busybox alike. Most katas have no binary files and none\n  over the size limit, so remove_binary_files and truncate_large_files\n  each ran their command with no file operand and it answered with a\n  usage error.\n\n  That noise went to the container's own stderr, which is the daemon's\n  second attach stream. The kata's stderr is a separate thing, arriving\n  as tmp/stderr inside the payload, so nothing in the suite looked at\n  the stream that carried it.\n\n  --no-run-if-empty is the long form of the flag, and both userlands\n  accept it, unlike xargs --null.\n\n* Give tar member names it has nothing to strip\n\n  The payload's member names are relative: tmp/stdout, and sandbox/...\n  for the kata's own files. runner.rb and Sandbox.out read them by those\n  names. tar asked to archive an absolute path makes them relative\n  itself, by stripping the leading /, and writes a warning about it to\n  the container's stderr. Both tar calls in send_tgz() did that, two\n  lines each, four on every test-run.\n\n  --directory / hands tar names that are already relative to it, so it\n  has nothing to strip and nothing to say. The member names are\n  unchanged: GNU tar 1.35 in a language image writes the same list\n  either way, tmp/stdout through sandbox/sub/b.txt.\n\n  c9Gf21 now pins the whole of it, that the container's stderr is empty.\n  That stream is the daemon's second attach stream, and separate from\n  the kata's own stderr, which arrives as tmp/stderr inside the payload.",
                "author": "Jon Jagger <jon@kosli.com>",
                "branch": "",
                "timestamp": 1788163580.0,
                "url": "https://github.com/cyber-dojo/runner/commit/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/runner-ci/artifacts/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638?artifact_id=3b03ceaf-96a6-4afa-8aa2-179e5fe9",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/runner-ci",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/runner/compare/976b63e8001ec7441ebc7737ca69f620d47e7ffe...ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
                "previous_git_commit": "976b63e8001ec7441ebc7737ca69f620d47e7ffe",
                "previous_fingerprint": "01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:976b63e@sha256:01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/runner/commit/976b63e8001ec7441ebc7737ca69f620d47e7ffe",
                "previous_trail_name": "976b63e8001ec7441ebc7737ca69f620d47e7ffe",
                "previous_template_reference_name": "runner"
              },
              "commit_lead_time": 92169.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-beta-per-artifact",
              "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
              "template_reference_name": "runner",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638?artifact_id=e9d1f562-ed75-4e9a-ac28-18bdf67f",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ad256a36cfd9d90f78acbf393e4bff5a2ef45fcf...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "ad256a36cfd9d90f78acbf393e4bff5a2ef45fcf",
                "previous_fingerprint": "fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:d7541d3@sha256:fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ad256a36cfd9d90f78acbf393e4bff5a2ef45fcf",
                "previous_trail_name": "runner-fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631",
                "previous_template_reference_name": "runner"
              },
              "commit_lead_time": 593762.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "production-promotion",
              "trail_name": "promote-all-34",
              "template_reference_name": "runner",
              "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "git_commit_info": {
                "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "message": "Drop lone use of = separator on Kosli CLI boolean flag",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1785316994.0,
                "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638?artifact_id=95170cfc-5215-420d-a2b0-83fee5dc",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_fingerprint": "01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:976b63e@sha256:01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_trail_name": "promotion-one-160",
                "previous_template_reference_name": "runner"
              },
              "commit_lead_time": 2938755.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-prod-per-artifact",
              "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
              "template_reference_name": "runner",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638?artifact_id=d21568bf-b02a-4532-a725-6fc824a6",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_fingerprint": "fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:d7541d3@sha256:fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_trail_name": "runner-fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631",
                "previous_template_reference_name": "runner"
              },
              "commit_lead_time": 593762.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            }
          ],
          "ecs_context": {
            "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/a8c4fce1500343aa9d5dd37759266af8",
            "cluster_name": null,
            "service_name": null
          }
        },
        {
          "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:bcac1c1@sha256:03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
          "compliant": true,
          "deployments": [],
          "policy_decisions": [
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "pull_request",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "pull-request"
            },
            {
              "policy_version": 3,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": true,
                      "exceptions": []
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.tags.kind == \"build\""
                      },
                      "name": "*",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0002"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0002"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "provenance"
            },
            {
              "policy_version": 4,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"snyk-aws-prod-per-artifact\""
                      },
                      "name": "snyk-container-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": "SDLC-CTRL-0022"
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null,
                        "for_control": "SDLC-CTRL-0022"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "snyk-scan-aws-prod"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "attestation",
                    "definition": {
                      "if": {
                        "text": "flow.name == \"production-promotion\""
                      },
                      "name": "snyk-scan",
                      "type": "decision",
                      "must_be_compliant": true,
                      "for_control": null
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    }
                  ]
                }
              ],
              "policy_name": "production-promotion"
            },
            {
              "policy_version": 2,
              "status": "COMPLIANT",
              "rule_evaluations": [
                {
                  "rule": {
                    "type": "provenance",
                    "definition": {
                      "required": false,
                      "exceptions": []
                    }
                  },
                  "satisfied": null,
                  "ignored": true,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": null
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": null
                      }
                    }
                  ]
                },
                {
                  "rule": {
                    "type": "trail-compliance",
                    "definition": {
                      "required": true,
                      "exceptions": [
                        {
                          "if": {
                            "text": "exists(flow.tags.env) and flow.tags.env != \"aws-prod\""
                          }
                        }
                      ]
                    }
                  },
                  "satisfied": true,
                  "ignored": false,
                  "resolutions": [
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "differ-ci",
                        "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_not_applicable",
                      "context": {
                        "flow_name": "snyk-aws-beta-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "production-promotion",
                        "trail_name": "promote-all-34",
                        "artifact_status": "COMPLIANT"
                      }
                    },
                    {
                      "type": "rule_satisfied",
                      "context": {
                        "flow_name": "snyk-aws-prod-per-artifact",
                        "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
                        "artifact_status": "COMPLIANT"
                      }
                    }
                  ]
                }
              ],
              "policy_name": "trail-compliance-aws-prod"
            }
          ],
          "reasons_for_incompliance": [],
          "fingerprint": "03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
          "creationTimestamp": [
            1788255749
          ],
          "pods": null,
          "annotation": {
            "type": "unchanged",
            "was": 1,
            "now": 1
          },
          "flow_name": "differ-ci",
          "git_commit": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
          "commit_url": "https://github.com/cyber-dojo/differ/commit/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
          "html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci/artifacts/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab?artifact_id=11345222-f37a-4f8d-8051-ec26a321",
          "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci",
          "deployment_diff": {
            "diff_url": "https://github.com/cyber-dojo/differ/compare/108cccf9bccf9af5d455db66c250480b53cbecc7...bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
            "previous_git_commit": "108cccf9bccf9af5d455db66c250480b53cbecc7",
            "previous_fingerprint": "31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac",
            "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:108cccf@sha256:31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac",
            "previous_artifact_compliance_state": "COMPLIANT",
            "previous_running": false,
            "previous_git_commit_url": "https://github.com/cyber-dojo/differ/commit/108cccf9bccf9af5d455db66c250480b53cbecc7",
            "previous_trail_name": "108cccf9bccf9af5d455db66c250480b53cbecc7",
            "previous_template_reference_name": "differ"
          },
          "commit_lead_time": 5862.0,
          "flows": [
            {
              "flow_name": "differ-ci",
              "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
              "template_reference_name": "differ",
              "git_commit": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
              "commit_url": "https://github.com/cyber-dojo/differ/commit/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
              "git_commit_info": {
                "sha1": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                "message": "Rerun workflow to see if it fixes sonar flake (#469)",
                "author": "Jon Jagger <jon@kosli.com>",
                "branch": "",
                "timestamp": 1788249887.0,
                "url": "https://github.com/cyber-dojo/differ/commit/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci/artifacts/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab?artifact_id=11345222-f37a-4f8d-8051-ec26a321",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/differ/compare/108cccf9bccf9af5d455db66c250480b53cbecc7...bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
                "previous_git_commit": "108cccf9bccf9af5d455db66c250480b53cbecc7",
                "previous_fingerprint": "31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:108cccf@sha256:31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/differ/commit/108cccf9bccf9af5d455db66c250480b53cbecc7",
                "previous_trail_name": "108cccf9bccf9af5d455db66c250480b53cbecc7",
                "previous_template_reference_name": "differ"
              },
              "commit_lead_time": 5862.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-beta-per-artifact",
              "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
              "template_reference_name": "differ",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab?artifact_id=c19121c7-2115-4fe0-b472-1d4ea833",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_fingerprint": "31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:108cccf@sha256:31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303",
                "previous_trail_name": "differ-31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac",
                "previous_template_reference_name": "differ"
              },
              "commit_lead_time": 593762.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "production-promotion",
              "trail_name": "promote-all-34",
              "template_reference_name": "differ",
              "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
              "git_commit_info": {
                "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "message": "Drop lone use of = separator on Kosli CLI boolean flag",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1785316994.0,
                "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab?artifact_id=868b85f5-e442-42ac-9474-0cbb1ab3",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_fingerprint": "31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:108cccf@sha256:31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584",
                "previous_trail_name": "promote-all-33",
                "previous_template_reference_name": "differ"
              },
              "commit_lead_time": 2938755.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            },
            {
              "flow_name": "snyk-aws-prod-per-artifact",
              "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
              "template_reference_name": "differ",
              "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933",
              "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933",
              "git_commit_info": {
                "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933",
                "message": "Unpack one pinned commit instead of fetching each file\n\n    a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n    the caller's checkout but left the prefix repeated at every use. The paths\n    are absolute because the run steps stay in the checkout, where the Kosli\n    CLI reads git commit information from the working directory, so the prefix\n    cannot be dropped. It can only be folded into the definitions, and a\n    literal /tmp folds where runner.temp does not: the runner context is\n    unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n    ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n    The files also arrived as five separate fetches of main, one per file, so a\n    push landing mid-run could pair a rego policy with params from a different\n    commit. find-snyk-vulns already checks this repo out, so it now publishes\n    the SHA it resolved, and the two later jobs unpack that exact commit as a\n    single tarball. One run reads one version.\n\n    An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n    this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n    produced by the run. That split is worth naming because only one of these\n    files is the caller's, and it is the one .snyk that the decision attests\n    against. Two bare filenames survive because an artifact name cannot\n    contain a '/'.\n\n    fetch-url-to-file now has exactly one caller, for that .snyk.",
                "author": "JonJagger <jon@kosli.com>",
                "branch": "main",
                "timestamp": 1787661987.0,
                "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933"
              },
              "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab?artifact_id=d014796c-e7b5-4b48-92f7-99ec7f8f",
              "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact",
              "deployment_diff": {
                "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933",
                "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_fingerprint": "902ec7af03407049ac6e5ef713146d518bbffd9d99cd28715fa0df973e809b7b",
                "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:981dcfc@sha256:902ec7af03407049ac6e5ef713146d518bbffd9d99cd28715fa0df973e809b7b",
                "previous_artifact_compliance_state": "COMPLIANT",
                "previous_running": false,
                "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26",
                "previous_trail_name": "differ-902ec7af03407049ac6e5ef713146d518bbffd9d99cd28715fa0df973e809b7b",
                "previous_template_reference_name": "differ"
              },
              "commit_lead_time": 593762.0,
              "artifact_compliance_in_flow": true,
              "flow_reasons_for_non_compliance": []
            }
          ],
          "ecs_context": {
            "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/2e9f021f4b484d48a46dc90a3b172b31",
            "cluster_name": null,
            "service_name": null
          }
        }
      ],
      "applied_policies": [
        {
          "id": "0b0c4d5a-cc1f-4725-8f97-af256289",
          "name": "pull-request",
          "version": 3,
          "policy_dump": {
            "schema_version": "1",
            "artifacts": {
              "provenance": {
                "required": false,
                "exceptions": []
              },
              "trail_compliance": {
                "required": false,
                "exceptions": []
              },
              "attestations": [
                {
                  "if_condition": {
                    "text": "flow.tags.kind == \"build\""
                  },
                  "name": "*",
                  "type": "pull_request",
                  "must_be_compliant": true,
                  "for_control": null
                }
              ]
            }
          },
          "failing_artifacts": []
        },
        {
          "id": "29f67c3c-1c1f-43f8-97e6-165a4080",
          "name": "provenance",
          "version": 3,
          "policy_dump": {
            "schema_version": "1",
            "artifacts": {
              "provenance": {
                "required": true,
                "exceptions": []
              },
              "trail_compliance": {
                "required": false,
                "exceptions": []
              },
              "attestations": [
                {
                  "if_condition": {
                    "text": "flow.tags.kind == \"build\""
                  },
                  "name": "*",
                  "type": "decision",
                  "must_be_compliant": true,
                  "for_control": "SDLC-CTRL-0002"
                }
              ]
            }
          },
          "failing_artifacts": []
        },
        {
          "id": "93d8505f-bce5-4c7c-a2c8-f98236c8",
          "name": "snyk-scan-aws-prod",
          "version": 4,
          "policy_dump": {
            "schema_version": "1",
            "artifacts": {
              "provenance": {
                "required": false,
                "exceptions": []
              },
              "trail_compliance": {
                "required": false,
                "exceptions": []
              },
              "attestations": [
                {
                  "if_condition": {
                    "text": "flow.name == \"snyk-aws-prod-per-artifact\""
                  },
                  "name": "snyk-container-scan",
                  "type": "decision",
                  "must_be_compliant": true,
                  "for_control": "SDLC-CTRL-0022"
                }
              ]
            }
          },
          "failing_artifacts": []
        },
        {
          "id": "bdb8a802-a406-4c76-b289-3fe30be3",
          "name": "production-promotion",
          "version": 2,
          "policy_dump": {
            "schema_version": "1",
            "artifacts": {
              "provenance": {
                "required": false,
                "exceptions": []
              },
              "trail_compliance": {
                "required": false,
                "exceptions": []
              },
              "attestations": [
                {
                  "if_condition": {
                    "text": "flow.name == \"production-promotion\""
                  },
                  "name": "snyk-scan",
                  "type": "decision",
                  "must_be_compliant": true,
                  "for_control": null
                }
              ]
            }
          },
          "failing_artifacts": []
        },
        {
          "id": "ce498d25-69dc-4f30-a71e-aa333990",
          "name": "trail-compliance-aws-prod",
          "version": 2,
          "policy_dump": {
            "schema_version": "1",
            "artifacts": {
              "provenance": {
                "required": false,
                "exceptions": []
              },
              "trail_compliance": {
                "required": true,
                "exceptions": [
                  {
                    "if_condition": {
                      "text": "exists(flow.tags.env) and flow.tags.env != \"aws-prod\""
                    }
                  }
                ]
              },
              "attestations": []
            }
          },
          "failing_artifacts": []
        }
      ]
    }
    ```
  </div>
</Accordion>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="get the latest snapshot of an environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get snapshot yourEnvironmentName

    ```
  </Accordion>

  <Accordion title="get the SECOND latest snapshot of an environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get snapshot yourEnvironmentName~1

    ```
  </Accordion>

  <Accordion title="get the snapshot number 23 of an environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get snapshot yourEnvironmentName#23

    ```
  </Accordion>

  <Accordion title="get the environment snapshot at midday (UTC), on valentine's day of 2023">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get snapshot yourEnvironmentName@{2023-02-14T12:00:00}

    ```
  </Accordion>

  <Accordion title="get the environment snapshot based on a relative time">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get snapshot yourEnvironmentName@{3.weeks.ago}
    ```
  </Accordion>
</AccordionGroup>


# kosli get trail
Source: https://docs.kosli.com/client_reference/kosli_get_trail

Get the metadata of a specific trail.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get trail TRAIL-NAME [flags]
```

Get the metadata of a specific trail.

## Flags

| Flag             | Type   | Description                                                                                           |
| :--------------- | :----- | :---------------------------------------------------------------------------------------------------- |
| `-f`, `--flow`   | string | The Kosli flow name.                                                                                  |
| `-h`, `--help`   | bool   | help for trail                                                                                        |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json, markdown]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Example

To view a live example of 'kosli get trail' you can run the command below (for the [cyber-dojo](https://app.kosli.com/cyber-dojo) demo organization).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
# The API token below is read-only
export KOSLI_API_TOKEN=Pj_XT2deaVA6V1qrTlthuaWsmjVt4eaHQwqnwqjRO3A
kosli get trail dashboard-ci e4757683b74df7033c95aa544a7824b395c2f8bb --output=json
```

<Accordion title="View example output">
  <div>
    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    {
      "name": "e4757683b74df7033c95aa544a7824b395c2f8bb",
      "description": "",
      "git_commit_info": {
        "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
        "message": "Update kosli template with provenance facts+decision (#414)",
        "author": "Jon Jagger <jon@kosli.com>",
        "branch": "main",
        "timestamp": 1783538510.0,
        "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb"
      },
      "origin_url": "https://github.com/cyber-dojo/dashboard/actions/runs/28969474194",
      "user_data": {},
      "repo_ids": [
        "4c546fde-c5ee-4a39-b399-8c71d7e1"
      ],
      "last_modified_at": 1783538679.7988548,
      "created_at": 1783538535.1534083,
      "compliance_status": {
        "status": "COMPLIANT",
        "is_compliant": true,
        "attestations_statuses": [
          {
            "attestation_name": "pull-request",
            "attestation_type": "pull_request",
            "attestation_id": "60045efd-1851-45f4-9b27-5f7ae946",
            "overridden_attestation_id": null,
            "status": "COMPLETE",
            "is_compliant": true,
            "unexpected": false
          }
        ],
        "artifacts_statuses": {
          "dashboard": {
            "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
            "artifact_id": "cc7c618f-d22e-4d95-b6f1-cea4fded",
            "status": "COMPLIANT",
            "is_compliant": true,
            "attestations_statuses": [
              {
                "attestation_name": "provenance-facts",
                "attestation_type": "custom:provenance-facts",
                "attestation_id": "8753765c-0df9-421c-bfe3-c8aa1f8d",
                "overridden_attestation_id": null,
                "status": "COMPLETE",
                "is_compliant": true,
                "unexpected": false
              },
              {
                "attestation_name": "provenance-decision",
                "attestation_type": "system:decision",
                "attestation_id": "b0786932-6ff7-4359-bb20-1bb43671",
                "overridden_attestation_id": null,
                "status": "COMPLETE",
                "is_compliant": true,
                "unexpected": false
              },
              {
                "attestation_name": "sbom-facts",
                "attestation_type": "custom:sbom-facts",
                "attestation_id": "7d834d1e-e7de-4890-870c-a783053b",
                "overridden_attestation_id": null,
                "status": "COMPLETE",
                "is_compliant": true,
                "unexpected": false
              },
              {
                "attestation_name": "sbom-decision",
                "attestation_type": "system:decision",
                "attestation_id": "d37cd3aa-3909-4d0d-a8c3-0c623de1",
                "overridden_attestation_id": null,
                "status": "COMPLETE",
                "is_compliant": true,
                "unexpected": false
              },
              {
                "attestation_name": "snyk-container-scan",
                "attestation_type": "system:decision",
                "attestation_id": "2e01c56f-18f9-4e75-8b45-f7d5846e",
                "overridden_attestation_id": null,
                "status": "COMPLETE",
                "is_compliant": true,
                "unexpected": false
              },
              {
                "attestation_name": "rubocop-lint",
                "attestation_type": "junit",
                "attestation_id": "d81b5df8-7c67-42ce-b332-5f10aba5",
                "overridden_attestation_id": null,
                "status": "COMPLETE",
                "is_compliant": true,
                "unexpected": false
              },
              {
                "attestation_name": "sonarcloud-scan",
                "attestation_type": "sonar",
                "attestation_id": "c955d971-4600-4b45-950f-cd8b3642",
                "overridden_attestation_id": null,
                "status": "COMPLETE",
                "is_compliant": true,
                "unexpected": false
              },
              {
                "attestation_name": "unit-test",
                "attestation_type": "junit",
                "attestation_id": "084be09c-f101-4a29-985e-ee305d60",
                "overridden_attestation_id": null,
                "status": "COMPLETE",
                "is_compliant": true,
                "unexpected": false
              },
              {
                "attestation_name": "unit-test-coverage",
                "attestation_type": "generic",
                "attestation_id": "ede0b52b-d56e-474f-b04c-03e6be01",
                "overridden_attestation_id": null,
                "status": "COMPLETE",
                "is_compliant": true,
                "unexpected": false
              }
            ],
            "unexpected": false,
            "evaluated_at": 1783538679.7988548,
            "flow_template_id": "cba69d3f-7f48-4e00-9c23-fb63f98d"
          }
        },
        "evaluated_at": 1783538658.411656,
        "flow_template_id": "cba69d3f-7f48-4e00-9c23-fb63f98d"
      },
      "template": {
        "version": 1,
        "trail": {
          "attestations": [
            {
              "name": "pull-request",
              "type": "pull_request"
            }
          ],
          "artifacts": [
            {
              "name": "dashboard",
              "attestations": [
                {
                  "name": "provenance-facts",
                  "type": "custom:provenance-facts"
                },
                {
                  "name": "provenance-decision",
                  "type": "decision"
                },
                {
                  "name": "sbom-facts",
                  "type": "custom:sbom-facts"
                },
                {
                  "name": "sbom-decision",
                  "type": "decision"
                },
                {
                  "name": "snyk-container-scan",
                  "type": "decision"
                },
                {
                  "name": "rubocop-lint",
                  "type": "junit"
                },
                {
                  "name": "sonarcloud-scan",
                  "type": "sonar"
                },
                {
                  "name": "unit-test",
                  "type": "junit"
                },
                {
                  "name": "unit-test-coverage",
                  "type": "generic"
                }
              ]
            }
          ]
        },
        "content": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: dashboard\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n\n        - name: rubocop-lint\n          type: junit\n        - name: sonarcloud-scan\n          type: sonar\n        - name: unit-test\n          type: junit\n        - name: unit-test-coverage\n          type: generic\n"
      },
      "compliance_state": "COMPLIANT",
      "is_compliant": true,
      "events": [
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538535.1534083,
          "type": "trail_reported",
          "git_commit_info": {
            "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "message": "Update kosli template with provenance facts+decision (#414)",
            "author": "Jon Jagger <jon@kosli.com>",
            "author_username": null,
            "branch": "main",
            "timestamp": 1783538510.0,
            "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb",
            "parents": null,
            "verified": null,
            "signature_state": null
          },
          "repo_info": {
            "inner_id": "4c546fde-c5ee-4a39-b399-8c71d7e1",
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "repo_id": "290597708",
            "name": "cyber-dojo/dashboard",
            "url": "https://github.com/cyber-dojo/dashboard",
            "provider": "github",
            "description": null,
            "vcs_instance": null,
            "namespace_path": null,
            "additional_info": null,
            "created_at": 1768639963.3866346,
            "last_modified_at": 1783538535.13884,
            "tags": {}
          },
          "setting_user_id": "da5d4ee8-aec0-4264-ab85-c491040c",
          "trail_data_json": {
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
            "name": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "creating_user_id": "da5d4ee8-aec0-4264-ab85-c491040c",
            "description": "",
            "git_commit_info": {
              "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
              "message": "Update kosli template with provenance facts+decision (#414)",
              "author": "Jon Jagger <jon@kosli.com>",
              "branch": "main",
              "timestamp": 1783538510.0,
              "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb"
            },
            "template_id": "cba69d3f-7f48-4e00-9c23-fb63f98d",
            "origin_url": "https://github.com/cyber-dojo/dashboard/actions/runs/28969474194",
            "user_data": "{}",
            "repo_ids": [
              "4c546fde-c5ee-4a39-b399-8c71d7e1"
            ]
          }
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538554.443048,
          "type": "trail_attestation_reported",
          "git_commit_info": {
            "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "message": "Update kosli template with provenance facts+decision (#414)",
            "author": "Jon Jagger <jon@kosli.com>",
            "author_username": null,
            "branch": "main",
            "timestamp": 1783538510.0,
            "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb",
            "parents": null,
            "verified": null,
            "signature_state": null
          },
          "repo_info": {
            "inner_id": "4c546fde-c5ee-4a39-b399-8c71d7e1",
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "repo_id": "290597708",
            "name": "cyber-dojo/dashboard",
            "url": "https://github.com/cyber-dojo/dashboard",
            "provider": "github",
            "description": null,
            "vcs_instance": null,
            "namespace_path": null,
            "additional_info": null,
            "created_at": 1768639963.3866346,
            "last_modified_at": 1783538554.4352667,
            "tags": {}
          },
          "attestation_type": "pull_request",
          "is_compliant": true,
          "attestation_id": "60045efd-1851-45f4-9b27-5f7ae946",
          "template_reference_name": "pull-request",
          "is_reattestation": null
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538566.412186,
          "type": "trail_attestation_for_artifact_reported",
          "git_commit_info": {
            "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "message": "Update kosli template with provenance facts+decision (#414)",
            "author": "Jon Jagger <jon@kosli.com>",
            "author_username": null,
            "branch": "main",
            "timestamp": 1783538510.0,
            "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb",
            "parents": null,
            "verified": null,
            "signature_state": null
          },
          "repo_info": {
            "inner_id": "4c546fde-c5ee-4a39-b399-8c71d7e1",
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "repo_id": "290597708",
            "name": "cyber-dojo/dashboard",
            "url": "https://github.com/cyber-dojo/dashboard",
            "provider": "github",
            "description": null,
            "vcs_instance": null,
            "namespace_path": null,
            "additional_info": null,
            "created_at": 1768639963.3866346,
            "last_modified_at": 1783538566.275227,
            "tags": {}
          },
          "attestation_type": "junit",
          "is_compliant": true,
          "attestation_id": "d81b5df8-7c67-42ce-b332-5f10aba5",
          "template_reference_name": "rubocop-lint",
          "is_reattestation": null,
          "target_artifact": "dashboard"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538599.9910955,
          "type": "artifact_creation_reported",
          "git_commit_info": {
            "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "message": "Update kosli template with provenance facts+decision (#414)",
            "author": "Jon Jagger <jon@kosli.com>",
            "author_username": null,
            "branch": "",
            "timestamp": 1783538510.0,
            "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb",
            "parents": null,
            "verified": null,
            "signature_state": null
          },
          "repo_info": {
            "inner_id": "4c546fde-c5ee-4a39-b399-8c71d7e1",
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "repo_id": "290597708",
            "name": "cyber-dojo/dashboard",
            "url": "https://github.com/cyber-dojo/dashboard",
            "provider": "github",
            "description": null,
            "vcs_instance": null,
            "namespace_path": null,
            "additional_info": null,
            "created_at": 1768639963.3866346,
            "last_modified_at": 1783538599.9776034,
            "tags": {}
          },
          "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
          "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:e475768",
          "artifact_id": "cc7c618f-d22e-4d95-b6f1-cea4fded",
          "template_reference_name": "dashboard",
          "git_commit": "e4757683b74df7033c95aa544a7824b395c2f8bb"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538601.4830513,
          "type": "artifact_attestation_reported",
          "git_commit_info": {
            "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "message": "Update kosli template with provenance facts+decision (#414)",
            "author": "Jon Jagger <jon@kosli.com>",
            "author_username": null,
            "branch": "",
            "timestamp": 1783538510.0,
            "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb",
            "parents": null,
            "verified": null,
            "signature_state": null
          },
          "repo_info": {
            "inner_id": "4c546fde-c5ee-4a39-b399-8c71d7e1",
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "repo_id": "290597708",
            "name": "cyber-dojo/dashboard",
            "url": "https://github.com/cyber-dojo/dashboard",
            "provider": "github",
            "description": null,
            "vcs_instance": null,
            "namespace_path": null,
            "additional_info": null,
            "created_at": 1768639963.3866346,
            "last_modified_at": 1783538601.4712045,
            "tags": {}
          },
          "attestation_type": "custom:provenance-facts",
          "is_compliant": true,
          "attestation_id": "8753765c-0df9-421c-bfe3-c8aa1f8d",
          "template_reference_name": "provenance-facts",
          "is_reattestation": null,
          "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
          "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:e475768",
          "target_artifact": "dashboard"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538605.8901985,
          "type": "artifact_attestation_reported",
          "git_commit_info": {
            "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "message": "Update kosli template with provenance facts+decision (#414)",
            "author": "Jon Jagger <jon@kosli.com>",
            "author_username": null,
            "branch": "",
            "timestamp": 1783538510.0,
            "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb",
            "parents": null,
            "verified": null,
            "signature_state": null
          },
          "repo_info": {
            "inner_id": "4c546fde-c5ee-4a39-b399-8c71d7e1",
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "repo_id": "290597708",
            "name": "cyber-dojo/dashboard",
            "url": "https://github.com/cyber-dojo/dashboard",
            "provider": "github",
            "description": null,
            "vcs_instance": null,
            "namespace_path": null,
            "additional_info": null,
            "created_at": 1768639963.3866346,
            "last_modified_at": 1783538605.7439284,
            "tags": {}
          },
          "attestation_type": "system:decision",
          "is_compliant": true,
          "attestation_id": "b0786932-6ff7-4359-bb20-1bb43671",
          "template_reference_name": "provenance-decision",
          "is_reattestation": null,
          "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
          "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:e475768",
          "target_artifact": "dashboard"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538607.5449562,
          "type": "artifact_attestation_reported",
          "git_commit_info": {
            "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "message": "Update kosli template with provenance facts+decision (#414)",
            "author": "Jon Jagger <jon@kosli.com>",
            "author_username": null,
            "branch": "",
            "timestamp": 1783538510.0,
            "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb",
            "parents": null,
            "verified": null,
            "signature_state": null
          },
          "repo_info": {
            "inner_id": "4c546fde-c5ee-4a39-b399-8c71d7e1",
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "repo_id": "290597708",
            "name": "cyber-dojo/dashboard",
            "url": "https://github.com/cyber-dojo/dashboard",
            "provider": "github",
            "description": null,
            "vcs_instance": null,
            "namespace_path": null,
            "additional_info": null,
            "created_at": 1768639963.3866346,
            "last_modified_at": 1783538607.5226355,
            "tags": {}
          },
          "attestation_type": "custom:sbom-facts",
          "is_compliant": true,
          "attestation_id": "7d834d1e-e7de-4890-870c-a783053b",
          "template_reference_name": "sbom-facts",
          "is_reattestation": null,
          "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
          "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:e475768",
          "target_artifact": "dashboard"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538609.6176646,
          "type": "trail_attestation_for_artifact_reported",
          "git_commit_info": {
            "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "message": "Update kosli template with provenance facts+decision (#414)",
            "author": "Jon Jagger <jon@kosli.com>",
            "author_username": null,
            "branch": "main",
            "timestamp": 1783538510.0,
            "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb",
            "parents": null,
            "verified": null,
            "signature_state": null
          },
          "repo_info": {
            "inner_id": "4c546fde-c5ee-4a39-b399-8c71d7e1",
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "repo_id": "290597708",
            "name": "cyber-dojo/dashboard",
            "url": "https://github.com/cyber-dojo/dashboard",
            "provider": "github",
            "description": null,
            "vcs_instance": null,
            "namespace_path": null,
            "additional_info": null,
            "created_at": 1768639963.3866346,
            "last_modified_at": 1783538609.6101015,
            "tags": {}
          },
          "attestation_type": "sonar",
          "is_compliant": true,
          "attestation_id": "c955d971-4600-4b45-950f-cd8b3642",
          "template_reference_name": "sonarcloud-scan",
          "is_reattestation": null,
          "target_artifact": "dashboard"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538612.6819937,
          "type": "artifact_attestation_reported",
          "git_commit_info": {
            "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "message": "Update kosli template with provenance facts+decision (#414)",
            "author": "Jon Jagger <jon@kosli.com>",
            "author_username": null,
            "branch": "",
            "timestamp": 1783538510.0,
            "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb",
            "parents": null,
            "verified": null,
            "signature_state": null
          },
          "repo_info": {
            "inner_id": "4c546fde-c5ee-4a39-b399-8c71d7e1",
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "repo_id": "290597708",
            "name": "cyber-dojo/dashboard",
            "url": "https://github.com/cyber-dojo/dashboard",
            "provider": "github",
            "description": null,
            "vcs_instance": null,
            "namespace_path": null,
            "additional_info": null,
            "created_at": 1768639963.3866346,
            "last_modified_at": 1783538612.5687785,
            "tags": {}
          },
          "attestation_type": "system:decision",
          "is_compliant": true,
          "attestation_id": "d37cd3aa-3909-4d0d-a8c3-0c623de1",
          "template_reference_name": "sbom-decision",
          "is_reattestation": null,
          "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
          "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:e475768",
          "target_artifact": "dashboard"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538656.9102154,
          "type": "artifact_attestation_reported",
          "git_commit_info": {
            "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "message": "Update kosli template with provenance facts+decision (#414)",
            "author": "Jon Jagger <jon@kosli.com>",
            "author_username": null,
            "branch": "main",
            "timestamp": 1783538510.0,
            "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb",
            "parents": null,
            "verified": null,
            "signature_state": null
          },
          "repo_info": {
            "inner_id": "4c546fde-c5ee-4a39-b399-8c71d7e1",
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "repo_id": "290597708",
            "name": "cyber-dojo/dashboard",
            "url": "https://github.com/cyber-dojo/dashboard",
            "provider": "github",
            "description": null,
            "vcs_instance": null,
            "namespace_path": null,
            "additional_info": null,
            "created_at": 1768639963.3866346,
            "last_modified_at": 1783538656.7741516,
            "tags": {}
          },
          "attestation_type": "junit",
          "is_compliant": true,
          "attestation_id": "084be09c-f101-4a29-985e-ee305d60",
          "template_reference_name": "unit-test",
          "is_reattestation": null,
          "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
          "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:e475768",
          "target_artifact": "dashboard"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538658.411656,
          "type": "artifact_attestation_reported",
          "git_commit_info": {
            "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "message": "Update kosli template with provenance facts+decision (#414)",
            "author": "Jon Jagger <jon@kosli.com>",
            "author_username": null,
            "branch": "main",
            "timestamp": 1783538510.0,
            "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb",
            "parents": null,
            "verified": null,
            "signature_state": null
          },
          "repo_info": {
            "inner_id": "4c546fde-c5ee-4a39-b399-8c71d7e1",
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "repo_id": "290597708",
            "name": "cyber-dojo/dashboard",
            "url": "https://github.com/cyber-dojo/dashboard",
            "provider": "github",
            "description": null,
            "vcs_instance": null,
            "namespace_path": null,
            "additional_info": null,
            "created_at": 1768639963.3866346,
            "last_modified_at": 1783538658.4029927,
            "tags": {}
          },
          "attestation_type": "generic",
          "is_compliant": true,
          "attestation_id": "ede0b52b-d56e-474f-b04c-03e6be01",
          "template_reference_name": "unit-test-coverage",
          "is_reattestation": null,
          "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
          "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:e475768",
          "target_artifact": "dashboard"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538679.7988548,
          "type": "artifact_attestation_reported",
          "git_commit_info": {
            "sha1": "e4757683b74df7033c95aa544a7824b395c2f8bb",
            "message": "Update kosli template with provenance facts+decision (#414)",
            "author": "Jon Jagger <jon@kosli.com>",
            "author_username": null,
            "branch": "main",
            "timestamp": 1783538510.0,
            "url": "https://github.com/cyber-dojo/dashboard/commit/e4757683b74df7033c95aa544a7824b395c2f8bb",
            "parents": null,
            "verified": null,
            "signature_state": null
          },
          "repo_info": {
            "inner_id": "4c546fde-c5ee-4a39-b399-8c71d7e1",
            "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
            "repo_id": "290597708",
            "name": "cyber-dojo/dashboard",
            "url": "https://github.com/cyber-dojo/dashboard",
            "provider": "github",
            "description": null,
            "vcs_instance": null,
            "namespace_path": null,
            "additional_info": null,
            "created_at": 1768639963.3866346,
            "last_modified_at": 1783538679.7007914,
            "tags": {}
          },
          "attestation_type": "system:decision",
          "is_compliant": true,
          "attestation_id": "2e01c56f-18f9-4e75-8b45-f7d5846e",
          "template_reference_name": "snyk-container-scan",
          "is_reattestation": null,
          "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
          "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:e475768",
          "target_artifact": "dashboard"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783538844.1212204,
          "type": "artifact_started_running",
          "git_commit_info": null,
          "repo_info": null,
          "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
          "environment_id": "e44779bb-311d-4bac-9d19-a64a0843",
          "environment_name": "aws-beta",
          "snapshot_index": 7637,
          "replica_number": 1,
          "template_reference_name": "dashboard"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783618198.4632592,
          "type": "artifact_started_running",
          "git_commit_info": null,
          "repo_info": null,
          "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
          "environment_id": "73965c45-e9a1-4bb9-ad01-dc5a526f",
          "environment_name": "aws-prod",
          "snapshot_index": 4974,
          "replica_number": 1,
          "template_reference_name": "dashboard"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1783660164.0318449,
          "type": "artifact_stopped_running",
          "git_commit_info": null,
          "repo_info": null,
          "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
          "environment_id": "e44779bb-311d-4bac-9d19-a64a0843",
          "environment_name": "aws-beta",
          "snapshot_index": 7657,
          "template_reference_name": "dashboard"
        },
        {
          "org_id": "83acb2bc-2c26-48a7-8b87-90dfcce7",
          "flow_id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
          "trail_id": "39e622ec-b847-447b-b7f8-7e9ea745",
          "timestamp": 1784356018.5146132,
          "type": "artifact_stopped_running",
          "git_commit_info": null,
          "repo_info": null,
          "artifact_fingerprint": "54f6da185cd0f0ef001a0b33c099565fa736546562e0411f706832e72dca47bb",
          "environment_id": "73965c45-e9a1-4bb9-ad01-dc5a526f",
          "environment_name": "aws-prod",
          "snapshot_index": 5044,
          "template_reference_name": "dashboard"
        }
      ],
      "created_by": "ci-pipelines",
      "flow": {
        "name": "dashboard-ci",
        "tags": {
          "ci": "github",
          "repo_url": "https://github.com/cyber-dojo/dashboard",
          "kind": "build",
          "env": "aws-beta"
        }
      },
      "external_urls": null,
      "html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/trails/e4757683b74df7033c95aa544a7824b395c2f8bb"
    }
    ```
  </div>
</Accordion>


# kosli join environment
Source: https://docs.kosli.com/client_reference/kosli_join_environment

Join a physical environment to a logical environment.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli join environment [flags]
```

Join a physical environment to a logical environment.

## Flags

| Flag              | Type   | Description                                                                                                                          |
| :---------------- | :----- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool   | help for environment                                                                                                                 |
| `--logical`       | string | \[required] The logical environment.                                                                                                 |
| `--physical`      | string | \[required] The physical environment.                                                                                                |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="join a physical environment to a logical environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli join environment 
    	--physical prod-k8 
    	--logical prod 
    ```
  </Accordion>
</AccordionGroup>


# kosli list api-keys
Source: https://docs.kosli.com/client_reference/kosli_list_api-keys

List API keys for a service account.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list api-keys [flags]
```

List API keys for a service account.

Only the metadata of each active API key is returned; the key values themselves are never
listed (they are only shown once, at creation or rotation time).

## Flags

| Flag                      | Type   | Description                                                                                 |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`            | bool   | help for api-keys                                                                           |
| `-o`, `--output`          | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |
| `-s`, `--service-account` | string | The name of the service account whose API keys are managed.                                 |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="list the API keys for a service account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list api-keys 
    	--service-account yourServiceAccountName 
    ```
  </Accordion>
</AccordionGroup>


# kosli list artifacts
Source: https://docs.kosli.com/client_reference/kosli_list_artifacts

List artifacts in a flow or repo. 

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list artifacts [flags]
```

List artifacts in a flow or repo. The results are paginated and ordered from latest to oldest.
By default, the page limit is 15 artifacts per page.

## Flags

| Flag                 | Type   | Description                                                                                 |
| :------------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-f`, `--flow`       | string | The Kosli flow name.                                                                        |
| `-h`, `--help`       | bool   | help for artifacts                                                                          |
| `-o`, `--output`     | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |
| `--page`             | int    | \[defaulted] The page number of a response. (default 1)                                     |
| `-n`, `--page-limit` | int    | \[defaulted] The number of elements per page. (default 15)                                  |
| `--repo`             | string | \[optional] The name of a git repo as it is registered in Kosli. e.g kosli-dev/cli          |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="list the last 15 artifacts for a flow">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list artifacts 

    ```
  </Accordion>

  <Accordion title="list the last 15 artifacts for a repo">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list artifacts 
    	--repo yourRepoName 

    ```
  </Accordion>

  <Accordion title="list the last 30 artifacts for a flow">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list artifacts 
    	--page-limit 30 

    ```
  </Accordion>

  <Accordion title="list the last 30 artifacts for a flow (in JSON)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list artifacts 
    	--page-limit 30 
    	--output json
    ```
  </Accordion>
</AccordionGroup>


# kosli list attestation-types
Source: https://docs.kosli.com/client_reference/kosli_list_attestation-types

List all Kosli attestation types for an org.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list attestation-types [flags]
```

List all Kosli attestation types for an org.

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for attestation-types                                                                  |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |


# kosli list controls
Source: https://docs.kosli.com/client_reference/kosli_list_controls

List controls for an org.

<Warning>
  This is a beta feature. Beta features provide early access to product
  functionality. These features may change between releases without warning, or
  can be removed in a future release. Please contact us to enable this feature
  for your organization.
</Warning>

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list controls [flags]
```

List controls for an org.
The results are paginated; use --page and --page-limit to navigate the pages.

## Flags

| Flag                 | Type        | Description                                                                                           |
| :------------------- | :---------- | :---------------------------------------------------------------------------------------------------- |
| `--archived`         | bool        | \[optional] List archived controls instead of active ones.                                            |
| `-h`, `--help`       | bool        | help for controls                                                                                     |
| `-o`, `--output`     | string      | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")           |
| `--page`             | int         | \[defaulted] The page number of a response. (default 1)                                               |
| `-n`, `--page-limit` | int         | \[defaulted] The number of elements per page. (default 15)                                            |
| `--search`           | string      | \[optional] Only list controls whose name or identifier contains this substring (case-insensitive).   |
| `--sort-direction`   | string      | \[optional] The direction to sort controls in. Valid values are: \[asc, desc]. (defaults to asc)      |
| `--tag`              | stringArray | \[optional] Filter by tag, given as 'key' or 'key:value'. Can be repeated to match more than one tag. |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="list the first page of controls for an org">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list controls 

    ```
  </Accordion>

  <Accordion title="list the second page of controls (10 per page) in JSON">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list controls 
    	--page 2 
    	--page-limit 10 
    	--output json 

    ```
  </Accordion>

  <Accordion title="list controls whose name or identifier contains 'sdlc'">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list controls 
    	--search sdlc 

    ```
  </Accordion>

  <Accordion title="list controls tagged framework=finos-sdlc (--tag can be repeated)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list controls 
    	--tag framework:finos-sdlc 

    ```
  </Accordion>

  <Accordion title="list archived controls instead of active ones">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list controls 
    	--archived 

    ```
  </Accordion>

  <Accordion title="list controls sorted in descending name order">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list controls 
    	--sort-direction desc 
    ```
  </Accordion>
</AccordionGroup>


# kosli list environments
Source: https://docs.kosli.com/client_reference/kosli_list_environments

List environments for an org.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list environments [flags]
```

List environments for an org.
By default, all environments are returned in one response.
When --page or --page-limit is set, the results are paginated and the response includes pagination metadata.
The list can be filtered by name, type, space and tags, and sorted with --sort and --sort-direction.

## Flags

| Flag                 | Type        | Description                                                                                                                                                                             |
| :------------------- | :---------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-h`, `--help`       | bool        | help for environments                                                                                                                                                                   |
| `--name`             | string      | \[optional] Only list environments whose name contains this substring (case-insensitive).                                                                                               |
| `-o`, `--output`     | string      | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")                                                                                             |
| `--page`             | int         | \[defaulted] The page number of a response. (default 1)                                                                                                                                 |
| `-n`, `--page-limit` | int         | \[defaulted] The number of elements per page. (default 15)                                                                                                                              |
| `--sort`             | string      | \[optional] The field to sort environments by. Valid values are: \[name, last\_modified\_at, last\_changed\_at]. (defaults to name)                                                     |
| `--sort-direction`   | string      | \[optional] The direction to sort environments in. Valid values are: \[asc, desc]. (defaults to asc)                                                                                    |
| `--space-id`         | strings     | \[optional] Only list environments in the space with this ID. Can be repeated to match more than one space.                                                                             |
| `--tag`              | stringArray | \[optional] Only list environments that have this tag, given as 'key' or 'key:value'. Can be repeated to match more than one tag.                                                       |
| `--type`             | strings     | \[optional] Only list environments of this type. Valid types are: \[K8S, ECS, S3, lambda, server, docker, azure-apps, cloud-run, logical]. Can be repeated to match more than one type. |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Example

To view a live example of 'kosli list environments' you can run the command below (for the [cyber-dojo](https://app.kosli.com/cyber-dojo) demo organization).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
# The API token below is read-only
export KOSLI_API_TOKEN=Pj_XT2deaVA6V1qrTlthuaWsmjVt4eaHQwqnwqjRO3A
kosli list environments --output=json
```

<Accordion title="View example output">
  <div>
    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    [
      {
        "org": "cyber-dojo",
        "name": "aws-beta",
        "type": "ECS",
        "description": "The ECS cluster for staging cyber-dojo",
        "last_modified_at": 1788260423.8795948,
        "last_reported_at": 1788260423.8795948,
        "last_changed_at": 1788256284.0239065,
        "state": true,
        "include_scaling": false,
        "tags": {
          "url": "https://beta.cyber-dojo.org/"
        },
        "policies": [
          "provenance",
          "pull-request",
          "snyk-scan-aws-beta",
          "trail-compliance-aws-beta"
        ],
        "included_environments": null
      },
      {
        "org": "cyber-dojo",
        "name": "aws-beta-terraform-drift-detection",
        "type": "server",
        "description": "Detection of drift of the Infrastructure-as-code components of aws-beta",
        "last_modified_at": 1788260408.588247,
        "last_reported_at": 1788260408.588247,
        "last_changed_at": 1788254708.6300995,
        "state": true,
        "include_scaling": false,
        "tags": {},
        "policies": [
          "provenance"
        ],
        "included_environments": null
      },
      {
        "org": "cyber-dojo",
        "name": "aws-prod",
        "type": "ECS",
        "description": "The ECS cluster for production cyber-dojo",
        "last_modified_at": 1788260398.5436597,
        "last_reported_at": 1788260398.5436597,
        "last_changed_at": 1788256325.6192138,
        "state": true,
        "include_scaling": false,
        "tags": {
          "url": "https://cyber-dojo.org/"
        },
        "policies": [
          "production-promotion",
          "provenance",
          "pull-request",
          "snyk-scan-aws-prod",
          "trail-compliance-aws-prod"
        ],
        "included_environments": null
      },
      {
        "org": "cyber-dojo",
        "name": "aws-prod-terraform-drift-detection",
        "type": "server",
        "description": "Detection of drift of the Infrastructure-as-code components of aws-prod",
        "last_modified_at": 1788260312.0991778,
        "last_reported_at": 1788260312.0991778,
        "last_changed_at": 1788256412.1366148,
        "state": true,
        "include_scaling": false,
        "tags": {},
        "policies": [
          "provenance"
        ],
        "included_environments": null
      },
      {
        "org": "cyber-dojo",
        "name": "production",
        "type": "logical",
        "description": "Production environments for cyber-dojo",
        "last_modified_at": 1788256412.1366148,
        "last_reported_at": null,
        "last_changed_at": 1788256412.1366148,
        "state": true,
        "include_scaling": false,
        "tags": {},
        "policies": null,
        "included_environments": [
          "aws-prod",
          "aws-prod-terraform-drift-detection"
        ]
      },
      {
        "org": "cyber-dojo",
        "name": "staging",
        "type": "logical",
        "description": "Staging environments for cyber-dojo",
        "last_modified_at": 1788256284.0239065,
        "last_reported_at": null,
        "last_changed_at": 1788256284.0239065,
        "state": true,
        "include_scaling": false,
        "tags": {},
        "policies": [],
        "included_environments": [
          "aws-beta",
          "aws-beta-terraform-drift-detection"
        ]
      }
    ]
    ```
  </div>
</Accordion>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="list all environments for an org">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list environments 

    ```
  </Accordion>

  <Accordion title="show the second page of environments, 25 per page">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list environments 
    	--page 2 
    	--page-limit 25 

    ```
  </Accordion>

  <Accordion title="list environments whose name contains a substring (in JSON)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list environments 
    	--name prod 
    	--output json 

    ```
  </Accordion>

  <Accordion title="list K8S and ECS environments tagged with team=platform">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list environments 
    	--type K8S 
    	--type ECS 
    	--tag team:platform 

    ```
  </Accordion>

  <Accordion title="list environments sorted by when they last changed, newest first">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list environments 
    	--sort last_changed_at 
    	--sort-direction desc 
    ```
  </Accordion>
</AccordionGroup>


# kosli list flows
Source: https://docs.kosli.com/client_reference/kosli_list_flows

List flows for an org. 

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list flows [flags]
```

List flows for an org. By default, all flows for the org are returned.
Pass --page-limit and/or --page to paginate the results; when pagination is requested the output
includes pagination metadata and a page footer (table) or a "data"/"pagination" envelope (JSON).
The list can be filtered by name with --name (and --ignore-case for case-insensitive matching).

## Flags

| Flag                  | Type   | Description                                                                                                             |
| :-------------------- | :----- | :---------------------------------------------------------------------------------------------------------------------- |
| `-h`, `--help`        | bool   | help for flows                                                                                                          |
| `-i`, `--ignore-case` | bool   | \[optional] Perform case-insensitive matching for `--name`. By default matching is case sensitive.                      |
| `-N`, `--name`        | string | \[optional] Only list flows whose name contains this substring. The Kosli API supports alphanumeric characters and '-'. |
| `-o`, `--output`      | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")                             |
| `--page`              | int    | \[defaulted] The page number of a response. (default 1)                                                                 |
| `-n`, `--page-limit`  | int    | \[defaulted] The number of elements per page. (default 20)                                                              |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Example

To view a live example of 'kosli list flows' you can run the command below (for the [cyber-dojo](https://app.kosli.com/cyber-dojo) demo organization).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
# The API token below is read-only
export KOSLI_API_TOKEN=Pj_XT2deaVA6V1qrTlthuaWsmjVt4eaHQwqnwqjRO3A
kosli list flows --output=json
```

<Accordion title="View example output">
  <div>
    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    [
      {
        "id": "e4e08b57-e36e-4724-acc8-04e7e437",
        "name": "creator-ci",
        "description": "UX for Group/Kata creation",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: creator\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n\n        - name: rubocop-lint\n          type: junit\n        - name: unit-test\n          type: junit\n        - name: unit-test-coverage\n          type: generic\n",
        "repo_url": "https://github.com/cyber-dojo/creator",
        "tags": {
          "ci": "github",
          "repo_url": "https://github.com/cyber-dojo/creator",
          "kind": "build",
          "env": "aws-beta"
        },
        "latest_activity_at": 1788256138.680238,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "217f4b82-2fe6-41ef-8214-e34c3a47",
        "name": "custom-start-points-ci",
        "description": "Custom exercises choices",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: custom-start-points\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n",
        "repo_url": "https://github.com/cyber-dojo/custom-start-points",
        "tags": {
          "ci": "github",
          "repo_url": "https://github.com/cyber-dojo/custom-start-points",
          "kind": "build",
          "env": "aws-beta"
        },
        "latest_activity_at": 1788255478.4228623,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "f60c8f3f-67cd-4496-8e17-ed6fdb1e",
        "name": "dashboard-ci",
        "description": "UX for a group practice dashboard",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: dashboard\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n\n        - name: rubocop-lint\n          type: junit\n        - name: sonarcloud-scan\n          type: sonar\n        - name: unit-test\n          type: junit\n        - name: unit-test-coverage\n          type: generic\n",
        "repo_url": "https://github.com/cyber-dojo/dashboard",
        "tags": {
          "ci": "github",
          "repo_url": "https://github.com/cyber-dojo/dashboard",
          "kind": "build",
          "env": "aws-beta"
        },
        "latest_activity_at": 1788255478.4228623,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "d398561b-b0a9-4f0e-95a3-bbb0e347",
        "name": "differ-ci",
        "description": "Diff files from two traffic-lights",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: differ\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n\n        - name: rubocop-lint\n          type: junit\n        - name: unit-test\n          type: junit\n        - name: unit-test-metrics\n          type: custom:test-metrics\n        - name: unit-test-coverage-metrics\n          type: custom:coverage-metrics\n        - name: integration-test\n          type: junit\n        - name: integration-test-metrics\n          type: custom:test-metrics\n        - name: integration-test-coverage-metrics\n          type: custom:coverage-metrics\n        - name: sonarcloud-scan\n          type: sonar\n",
        "repo_url": "https://github.com/cyber-dojo/differ",
        "tags": {
          "ci": "github",
          "repo_url": "https://github.com/cyber-dojo/differ",
          "kind": "build",
          "env": "aws-beta"
        },
        "latest_activity_at": 1788255838.4418423,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "c1bb83be-5195-4814-9fae-eac6bf67",
        "name": "exercises-start-points-ci",
        "description": "Exercises choices",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: exercises-start-points\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n",
        "repo_url": "https://github.com/cyber-dojo/exercises-start-points",
        "tags": {
          "ci": "github",
          "repo_url": "https://github.com/cyber-dojo/exercises-start-points",
          "kind": "build",
          "env": "aws-beta"
        },
        "latest_activity_at": 1788255478.4228623,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "0b4a3bb0-4f77-41a9-8dea-733d1dc3",
        "name": "languages-start-points-ci",
        "description": "Language+TestFramework choices",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: languages-start-points\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n",
        "repo_url": "https://github.com/cyber-dojo/languages-start-points",
        "tags": {
          "ci": "github",
          "repo_url": "https://github.com/cyber-dojo/languages-start-points",
          "kind": "build",
          "env": "aws-beta"
        },
        "latest_activity_at": 1788255838.4418423,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "d81371fe-6264-4bb1-aace-9b0af86c",
        "name": "monorepo-co-deployment",
        "description": "Bind shared commit deployments",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1",
        "repo_url": "https://github.com/cyber-dojo/monorepo",
        "tags": {},
        "latest_activity_at": 1781600733.1821082,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "10751390-44e0-4d32-a860-bd5f7584",
        "name": "monorepo-creator",
        "description": "UX for Group/Kata creation",
        "visibility": "public",
        "org": "cyber-dojo",
        "template": "\nversion: 1\ntrail:\n  attestations:\n    - { name: pull-request, type: pull_request }\n  artifacts:\n    - name: creator\n      attestations:\n        - { name: unit-test, type: junit }\n",
        "repo_url": "https://github.com/cyber-dojo/monorepo",
        "tags": {},
        "latest_activity_at": 1781600708.1972978,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "0f0e3f56-f7ac-4830-acc3-3a36e111",
        "name": "monorepo-dashboard",
        "description": "UX for a group practice dashboard",
        "visibility": "public",
        "org": "cyber-dojo",
        "template": "\nversion: 1\ntrail:\n  attestations:\n    - { name: pull-request, type: pull_request }\n  artifacts:\n    - name: dashboard\n      attestations:\n        - { name: rubocop,             type: junit }\n        - { name: snyk-container-scan, type: generic }\n",
        "repo_url": "https://github.com/cyber-dojo/monorepo",
        "tags": {},
        "latest_activity_at": 1781600707.3320358,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "c03d5ba2-cb6e-4f6c-a5ec-05805c49",
        "name": "monorepo-web",
        "description": "UX for practicing TDD",
        "visibility": "public",
        "org": "cyber-dojo",
        "template": "\nversion: 1\ntrail:\n  attestations:\n    - { name: pull-request, type: pull_request }\n  artifacts:\n    - name: web\n      attestations:\n        - { name: lint,      type: generic }\n        - { name: unit-test, type: junit }\n",
        "repo_url": "https://github.com/cyber-dojo/monorepo",
        "tags": {},
        "latest_activity_at": 1781600712.989079,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "28447c7d-904b-4594-8b05-88d5d938",
        "name": "nginx-ci",
        "description": "Reverse proxy",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: nginx\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n",
        "repo_url": "https://github.com/cyber-dojo/nginx",
        "tags": {
          "ci": "github",
          "repo_url": "https://github.com/cyber-dojo/nginx",
          "kind": "build",
          "env": "aws-beta"
        },
        "latest_activity_at": 1788255838.4418423,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "d454e45e-3746-417f-992c-e41515d5",
        "name": "production-promotion",
        "description": "Promotes sets of Artifacts from aws-beta to aws-prod",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\n\ntrail:\n  attestations:\n    - name: all-promotions\n      type: generic\n",
        "repo_url": "https://github.com/cyber-dojo/aws-prod-co-promotion",
        "tags": {
          "ci": "github",
          "repo_url": "https://github.com/cyber-dojo/aws-prod-co-promotion",
          "kind": "release",
          "env": "aws-prod"
        },
        "latest_activity_at": 1788254949.8226013,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "4afd2a1f-5045-4145-934a-64b533a6",
        "name": "production-server-access",
        "description": "Flow to track production server access",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n  - name: command-logs\n    type: generic\n  - name: user-identity\n    type: generic\n  - name: service-identity\n    type: generic\n  - name: sso-session-data\n    type: generic\n",
        "repo_url": "",
        "tags": {},
        "latest_activity_at": 1711724314.4139948,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "a81e8c6d-bb00-474f-b986-a6cb9b08",
        "name": "runner-ci",
        "description": "Test runner",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: runner\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n\n        - name: rubocop-lint\n          type: junit\n\n        - name: unit-test\n          type: junit\n        - name: unit-test-metrics\n          type: custom:test-metrics\n        - name: unit-test-coverage-metrics\n          type: custom:coverage-metrics\n\n        - name: integration-test\n          type: junit\n        - name: integration-test-metrics\n          type: custom:test-metrics\n        - name: integration-test-coverage-metrics\n          type: custom:coverage-metrics\n",
        "repo_url": "https://github.com/cyber-dojo/runner",
        "tags": {
          "ci": "github",
          "repo_url": "https://github.com/cyber-dojo/runner",
          "kind": "build",
          "env": "aws-beta"
        },
        "latest_activity_at": 1788255898.5005004,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "e54bdf65-de27-448f-807a-08e09590",
        "name": "saver-ci",
        "description": "Group/Kata model+persistence",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: saver\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n\n        - name: unit-test\n          type: junit\n        - name: unit-test-metrics\n          type: custom:test-metrics\n        - name: unit-test-coverage-metrics\n          type: custom:coverage-metrics\n        - name: integration-test\n          type: junit\n        - name: integration-test-metrics\n          type: custom:test-metrics\n        - name: integration-test-coverage-metrics\n          type: custom:coverage-metrics\n\n",
        "repo_url": "https://github.com/cyber-dojo/saver",
        "tags": {
          "ci": "github",
          "repo_url": "https://github.com/cyber-dojo/saver",
          "kind": "build",
          "env": "aws-beta"
        },
        "latest_activity_at": 1788255478.4228623,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "9a967617-89c5-4121-ab26-99e1f4ae",
        "name": "secrets",
        "description": "Kosli new/expiring secrets check",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations: []\n  artifacts:\n  - name: artifact\n    attestations: []\n",
        "repo_url": "",
        "tags": {
          "ci": "github",
          "kind": "run",
          "repo_url": "https://github.com/cyber-dojo/secrets"
        },
        "latest_activity_at": 1788249204.33249,
        "latest_state": "NON-COMPLIANT"
      },
      {
        "id": "a43239d6-fa3d-4e58-b7c4-f00b7432",
        "name": "snyk-aws-beta-per-artifact",
        "description": "Snyk vulns in aws-beta artifacts",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1",
        "repo_url": "https://github.com/cyber-dojo/snyk-scanning",
        "tags": {
          "ci": "github",
          "kind": "run",
          "workflow_url": "https://github.com/cyber-dojo/snyk-scanning/blob/main/.github/workflows/aws-beta.yml",
          "env": "aws-beta"
        },
        "latest_activity_at": 1788254744.4473586,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "e0f4dbb0-0d25-44d0-8aa1-ced9876e",
        "name": "snyk-aws-beta-per-vuln",
        "description": "Individual Snyk vuln trails for aws-beta artifacts",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1",
        "repo_url": "",
        "tags": {
          "ci": "github",
          "env": "aws-beta",
          "kind": "run",
          "workflow_url": "https://github.com/cyber-dojo/snyk-scanning/blob/main/.github/workflows/artifact_snyk_test.yml"
        },
        "latest_activity_at": 1788252975.2436972,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "021d42e3-f52e-4e48-959b-33f1fd60",
        "name": "snyk-aws-prod-per-artifact",
        "description": "Snyk vulns in aws-prod artifacts",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1",
        "repo_url": "https://github.com/cyber-dojo/snyk-scanning",
        "tags": {
          "ci": "github",
          "kind": "run",
          "workflow_url": "https://github.com/cyber-dojo/snyk-scanning/blob/main/.github/workflows/aws-prod.yml",
          "env": "aws-prod"
        },
        "latest_activity_at": 1788256311.5220706,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "7fc06a03-241f-4b17-baa1-05cf7585",
        "name": "snyk-aws-prod-per-vuln",
        "description": "Individual Snyk vuln trails for aws-prod artifacts",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1",
        "repo_url": "",
        "tags": {
          "ci": "github",
          "env": "aws-prod",
          "kind": "run",
          "workflow_url": "https://github.com/cyber-dojo/snyk-scanning/blob/main/.github/workflows/artifact_snyk_test.yml"
        },
        "latest_activity_at": 1788256281.9068878,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "6d59cdf1-0d6b-412a-bd81-ecdc8767",
        "name": "spooler-ci",
        "description": "Async write spooler: durable, ordered forwarding to saver",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: spooler\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n\n        - name: unit-test\n          type: junit\n        - name: unit-test-metrics\n          type: custom:test-metrics\n        - name: unit-test-coverage-metrics\n          type: custom:coverage-metrics\n        - name: integration-test\n          type: junit\n        - name: integration-test-metrics\n          type: custom:test-metrics\n        - name: integration-test-coverage-metrics\n          type: custom:coverage-metrics\n",
        "repo_url": "https://github.com/cyber-dojo/spooler",
        "tags": {
          "env": "aws-beta"
        },
        "latest_activity_at": 1788255478.4228623,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "57de7461-f687-4b93-a1d7-d4268e44",
        "name": "terraform-apply-beta-creator",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/creator",
        "tags": {},
        "latest_activity_at": 1787836208.8569806,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "63ea4110-f185-4a04-ae62-8519474b",
        "name": "terraform-apply-beta-custom-start-points",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/custom-start-points",
        "tags": {},
        "latest_activity_at": 1787839208.4459617,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "ceb02030-a523-436d-86a5-c45270dc",
        "name": "terraform-apply-beta-dashboard",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/dashboard",
        "tags": {},
        "latest_activity_at": 1787843108.7875247,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "92d8c902-3dc1-4db5-ad07-6ceabc1e",
        "name": "terraform-apply-beta-differ",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/differ",
        "tags": {},
        "latest_activity_at": 1788250508.7286773,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "3a0768fb-33b4-47f6-ba63-5c69df8e",
        "name": "terraform-apply-beta-exercises-start-points",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/exercises-start-points",
        "tags": {},
        "latest_activity_at": 1787839208.4459617,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "03286d89-1428-4077-9294-fddf609b",
        "name": "terraform-apply-beta-languages-start-points",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/languages-start-points",
        "tags": {},
        "latest_activity_at": 1788246608.7289636,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "152592aa-87a9-46e5-9b4b-2180b0b5",
        "name": "terraform-apply-beta-nginx",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/nginx",
        "tags": {},
        "latest_activity_at": 1788254708.6300995,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "091c0875-2863-48cb-b1f5-e08bb8dd",
        "name": "terraform-apply-beta-runner",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/runner",
        "tags": {},
        "latest_activity_at": 1788164408.5952742,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "348ea96a-84ba-4c17-8ed9-55b397f2",
        "name": "terraform-apply-beta-saver",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/saver",
        "tags": {},
        "latest_activity_at": 1788252908.7716892,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "418dcba5-0f85-44c1-9bfa-73fe61a2",
        "name": "terraform-apply-beta-spooler",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/spooler",
        "tags": {},
        "latest_activity_at": 1787904009.021726,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "0408259b-db9a-47b4-bd5d-2cafb533",
        "name": "terraform-apply-beta-terraform-base-infra",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/terraform-base-infra",
        "tags": {},
        "latest_activity_at": 1785232808.6739333,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "60bfe410-ffe9-421e-a347-0bbd1554",
        "name": "terraform-apply-beta-web",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/web",
        "tags": {},
        "latest_activity_at": 1787905808.789012,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "61ab4b1c-5b59-4f2b-a484-86b887cb",
        "name": "terraform-apply-prod-aws-prod-co-promotion",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/runner",
        "tags": {},
        "latest_activity_at": 1788256412.1366148,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "72787a36-70df-447a-9fae-9c860aa7",
        "name": "terraform-apply-prod-runner",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/runner",
        "tags": {},
        "latest_activity_at": 1788074911.8576832,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "d32a5b61-d72c-4279-824a-55226c4b",
        "name": "terraform-apply-prod-terraform-base-infra",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n    - name: terraform-apply\n      type: generic\n    - name: pull-request\n      type: pull_request\n  artifacts:\n    - name: terraform-state\n    - name: drift-plan\n",
        "repo_url": "https://github.com/cyber-dojo/terraform-base-infra",
        "tags": {},
        "latest_activity_at": 1785236322.8149745,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "cf915667-e09e-4451-b689-8efe0605",
        "name": "terraform-plan-beta-terraform-base-infra",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n",
        "repo_url": "",
        "tags": {},
        "latest_activity_at": 1785166016.9913907,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "27cb0696-7226-4420-b4c9-b8c91ed7",
        "name": "terraform-plan-prod-terraform-base-infra",
        "description": "",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\ntrail:\n  attestations:\n    - name: terraform-plan\n      type: generic\n",
        "repo_url": "",
        "tags": {},
        "latest_activity_at": 1785232718.7436328,
        "latest_state": "COMPLIANT"
      },
      {
        "id": "fd583a48-28de-4b5c-b4a7-b6356e94",
        "name": "web-ci",
        "description": "UX for practicing TDD",
        "visibility": "private",
        "org": "cyber-dojo",
        "template": "version: 1\n\ntrail:\n  attestations:\n    - name: pull-request\n      type: pull_request\n\n  artifacts:\n    - name: web\n      attestations:\n        - name: provenance-facts\n          type: custom:provenance-facts\n        - name: provenance-decision\n          type: decision\n\n        - name: sbom-facts\n          type: custom:sbom-facts\n        - name: sbom-decision\n          type: decision\n\n        - name: snyk-container-scan\n          type: decision\n\n        - name: rubocop-lint\n          type: junit\n\n        - name: server-test\n          type: junit\n\n        - name: test-facts\n          type: custom:test-facts\n        - name: test-decision\n          type: decision\n\n        - name: coverage-facts\n          type: custom:coverage-facts\n        - name: coverage-decision\n          type: decision\n",
        "repo_url": "https://github.com/cyber-dojo/web",
        "tags": {
          "ci": "github",
          "repo_url": "https://github.com/cyber-dojo/web",
          "kind": "build",
          "env": "aws-beta"
        },
        "latest_activity_at": 1788074998.5362537,
        "latest_state": "COMPLIANT"
      }
    ]
    ```
  </div>
</Accordion>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="list all flows for an org">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list flows 

    ```
  </Accordion>

  <Accordion title="list the first 30 flows (paginated)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list flows 
    	--page-limit 30 

    ```
  </Accordion>

  <Accordion title="show the second page of flows (30 per page)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list flows 
    	--page-limit 30 
    	--page 2 

    ```
  </Accordion>

  <Accordion title="list flows whose name contains 'backend' (in JSON)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list flows 
    	--name backend 
    	--output json
    ```
  </Accordion>
</AccordionGroup>


# kosli list policies
Source: https://docs.kosli.com/client_reference/kosli_list_policies

List environment policies for an org.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list policies [flags]
```

List environment policies for an org.

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for policies                                                                           |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |


# kosli list repos
Source: https://docs.kosli.com/client_reference/kosli_list_repos

List repos for an org.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list repos [flags]
```

List repos for an org. The results are always paginated:
by default the first page is returned with 15 repos per page. Use --page to select
a page and --page-limit to change the page size (maximum 50).
The list can be filtered by name with --name (exact match), by name substring with
\--search (case-insensitive, mutually exclusive with --name), by VCS provider with
\--provider, by external repo ID with --repo-id, and by tags with --tag.
Results are sorted by repo name; use --sort-direction to choose asc or desc.

## Flags

| Flag                 | Type        | Description                                                                                                                |
| :------------------- | :---------- | :------------------------------------------------------------------------------------------------------------------------- |
| `-h`, `--help`       | bool        | help for repos                                                                                                             |
| `--name`             | string      | \[optional] The repo name to filter by (exact match).                                                                      |
| `-o`, `--output`     | string      | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")                                |
| `--page`             | int         | \[defaulted] The page number of a response. (default 1)                                                                    |
| `-n`, `--page-limit` | int         | \[defaulted] The number of elements per page. (default 15)                                                                 |
| `--provider`         | string      | \[optional] The VCS provider to filter repos by (e.g. github, gitlab).                                                     |
| `--repo-id`          | string      | \[optional] The external repo ID to filter repos by.                                                                       |
| `--search`           | string      | \[optional] Filter repos whose name contains this substring (case-insensitive). Mutually exclusive with `--name`.          |
| `--sort-direction`   | string      | \[optional] The direction to sort repos by name. Valid values are: \[asc, desc]. (defaults to asc)                         |
| `--tag`              | stringArray | \[optional] Only list repos that have this tag, given as 'key' or 'key:value'. Can be repeated to match more than one tag. |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="list repos for an org (first page, 15 per page)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list repos 

    ```
  </Accordion>

  <Accordion title="list repos filtered by name (exact match on the full repo name)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list repos 
    	--name my-org/my-repo 

    ```
  </Accordion>

  <Accordion title="list repos whose name contains a substring (case-insensitive)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list repos 
    	--search cli 

    ```
  </Accordion>

  <Accordion title="list repos filtered by VCS provider (in JSON)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list repos 
    	--provider github 
    	--output json

    ```
  </Accordion>

  <Accordion title="list repos tagged with team=platform">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list repos 
    	--tag team:platform 

    ```
  </Accordion>

  <Accordion title="list repos sorted by name, Z–A">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list repos 
    	--sort-direction desc 

    ```
  </Accordion>

  <Accordion title="show the second page of repos (25 per page)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list repos 
    	--page-limit 25 
    	--page 2 
    ```
  </Accordion>
</AccordionGroup>


# kosli list service-accounts
Source: https://docs.kosli.com/client_reference/kosli_list_service-accounts

List service accounts in an organization.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list service-accounts [flags]
```

List service accounts in an organization.

Each entry shows the name, description, privilege, and creation time. The secret
values of any API keys are never listed. Use `--output json` to get the raw
response for scripting.

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for service-accounts                                                                   |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="list the service accounts in an organization">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list service-accounts 
    ```
  </Accordion>
</AccordionGroup>


# kosli list snapshots
Source: https://docs.kosli.com/client_reference/kosli_list_snapshots

List environment snapshots.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list snapshots ENV_NAME [flags]
```

List environment snapshots.
The results are paginated and ordered from latest to oldest.
By default, the page limit is 15 snapshots per page.

You can optionally specify an INTERVAL between two snapshot expressions with \[expression]..\[expression].

Expressions can be:

* \~N   N'th behind the latest snapshot
* N    snapshot number N
* NOW  the latest snapshot

Either expression can be omitted to default to NOW.

## Flags

| Flag                 | Type   | Description                                                                                 |
| :------------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`       | bool   | help for snapshots                                                                          |
| `-i`, `--interval`   | string | \[optional] Expression to define specified snapshots range.                                 |
| `-o`, `--output`     | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |
| `--page`             | int    | \[defaulted] The page number of a response. (default 1)                                     |
| `-n`, `--page-limit` | int    | \[defaulted] The number of elements per page. (default 15)                                  |
| `--reverse`          | bool   | \[optional] Reverse the order of output list.                                               |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Example

To view a live example of 'kosli list snapshots' you can run the command below (for the [cyber-dojo](https://app.kosli.com/cyber-dojo) demo organization).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
# The API token below is read-only
export KOSLI_API_TOKEN=Pj_XT2deaVA6V1qrTlthuaWsmjVt4eaHQwqnwqjRO3A
kosli list snapshots aws-prod --output=json
```

<Accordion title="View example output">
  <div>
    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    [
      {
        "index": 5309,
        "from": 1788256325.6192138,
        "to": 0.0,
        "compliant": true,
        "duration": 4114.5881407260895
      },
      {
        "index": 5308,
        "from": 1788256258.609352,
        "to": 1788256325.6192138,
        "compliant": true,
        "duration": 67.00986170768738
      },
      {
        "index": 5307,
        "from": 1788256138.680238,
        "to": 1788256258.609352,
        "compliant": true,
        "duration": 119.92911410331726
      },
      {
        "index": 5306,
        "from": 1788256078.451175,
        "to": 1788256138.680238,
        "compliant": true,
        "duration": 60.22906303405762
      },
      {
        "index": 5305,
        "from": 1788255898.5005004,
        "to": 1788256078.451175,
        "compliant": true,
        "duration": 179.950674533844
      },
      {
        "index": 5304,
        "from": 1788255838.4418423,
        "to": 1788255898.5005004,
        "compliant": true,
        "duration": 60.05865812301636
      },
      {
        "index": 5303,
        "from": 1788255778.7566388,
        "to": 1788255838.4418423,
        "compliant": true,
        "duration": 59.685203552246094
      },
      {
        "index": 5302,
        "from": 1788255478.4228623,
        "to": 1788255778.7566388,
        "compliant": true,
        "duration": 300.333776473999
      },
      {
        "index": 5301,
        "from": 1788255418.2849495,
        "to": 1788255478.4228623,
        "compliant": true,
        "duration": 60.13791275024414
      },
      {
        "index": 5300,
        "from": 1788254758.42325,
        "to": 1788255418.2849495,
        "compliant": true,
        "duration": 659.8616995811462
      },
      {
        "index": 5299,
        "from": 1788253018.4181795,
        "to": 1788254758.42325,
        "compliant": true,
        "duration": 1740.0050704479218
      },
      {
        "index": 5298,
        "from": 1788251398.4699006,
        "to": 1788253018.4181795,
        "compliant": true,
        "duration": 1619.9482789039612
      },
      {
        "index": 5297,
        "from": 1788245458.5681827,
        "to": 1788251398.4699006,
        "compliant": true,
        "duration": 5939.90171790123
      },
      {
        "index": 5296,
        "from": 1788245398.8278637,
        "to": 1788245458.5681827,
        "compliant": true,
        "duration": 59.74031901359558
      },
      {
        "index": 5295,
        "from": 1788245338.6744468,
        "to": 1788245398.8278637,
        "compliant": true,
        "duration": 60.153416872024536
      }
    ]
    ```
  </div>
</Accordion>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="list the last 15 snapshots for an environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list snapshots yourEnvironmentName 

    ```
  </Accordion>

  <Accordion title="list the last 30 snapshots for an environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list snapshots yourEnvironmentName 
    	--page-limit 30 

    ```
  </Accordion>

  <Accordion title="list the last 30 snapshots for an environment (in JSON)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list snapshots yourEnvironmentName 
    	--page-limit 30 
    	--output json
    ```
  </Accordion>
</AccordionGroup>


# kosli list trails
Source: https://docs.kosli.com/client_reference/kosli_list_trails

List Trails of an org.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list trails [flags]
```

List Trails of an org.The list can be filtered by flow, flow tag and artifact fingerprint. When multiple filters are provided, only trails matching all specified criteria are returned. The results are paginated and ordered from latest to oldest.

## Flags

| Flag                  | Type   | Description                                                                                 |
| :-------------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-F`, `--fingerprint` | string | \[optional] The SHA256 fingerprint of the artifact to filter trails by.                     |
| `-f`, `--flow`        | string | \[optional] The Kosli flow name.                                                            |
| `-t`, `--flow-tag`    | string | \[optional] A key=value flow tag to filter trails by.                                       |
| `-h`, `--help`        | bool   | help for trails                                                                             |
| `-o`, `--output`      | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |
| `--page`              | int    | \[defaulted] The page number of a response. (default 1)                                     |
| `-n`, `--page-limit`  | int    | \[defaulted] The number of elements per page. (default 20)                                  |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="get a paginated list of trails for a flow">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list trails 

    ```
  </Accordion>

  <Accordion title="list the most recent 30 trails for a flow">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list trails 
    	--page-limit 30 

    ```
  </Accordion>

  <Accordion title="show the second page of trails for a flow">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list trails 
    	--page-limit 30 
    	--page 2 

    ```
  </Accordion>

  <Accordion title="get a paginated list of trails for a flow (in JSON)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list trails 
    	--output json

    ```
  </Accordion>

  <Accordion title="get a paginated list of trails across all flows that contain an artifact with the provided fingerprint (in JSON)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list trails 
    	--fingerprint yourArtifactFingerprint 
    	--output json

    	# get a paginated list of trails across all flows tagged with the provided key-value pair:
    kosli list trails 
    	--flow-tag team=backend 
    ```
  </Accordion>
</AccordionGroup>


# kosli log environment
Source: https://docs.kosli.com/client_reference/kosli_log_environment

List environment events.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli log environment ENV_NAME [flags]
```

List environment events.
The results are paginated and ordered from latest to oldest.
By default, the page limit is 15 events per page.

You can optionally specify an INTERVAL between two snapshot expressions with \[expression]..\[expression].

Expressions can be:

* \~N   N'th behind the latest snapshot
* N    snapshot number N
* NOW  the latest snapshot

Either expression can be omitted to default to NOW.

You can also filter events by range using --start/--end (snapshot index or time expression such as "NOW" or "1hour") or --start-ts/--end-ts (Unix timestamps).

## Flags

| Flag                 | Type    | Description                                                                                                          |
| :------------------- | :------ | :------------------------------------------------------------------------------------------------------------------- |
| `--end`              | string  | \[optional] The end of the events range. Can be a snapshot index (integer) or a time expression (e.g. NOW, 1hour).   |
| `--end-ts`           | float   | \[optional] The end of the events range as a Unix timestamp in seconds (integer or float).                           |
| `-h`, `--help`       | bool    | help for environment                                                                                                 |
| `-i`, `--interval`   | string  | \[optional] Expression to define specified snapshots range.                                                          |
| `-o`, `--output`     | string  | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")                          |
| `--page`             | int     | \[defaulted] The page number of a response. (default 1)                                                              |
| `-n`, `--page-limit` | int     | \[defaulted] The number of elements per page. (default 15)                                                           |
| `--repo`             | strings | \[optional] The name of a git repo as it is registered in Kosli. e.g kosli-dev/cli                                   |
| `--reverse`          | bool    | \[optional] Reverse the order of output list.                                                                        |
| `--start`            | string  | \[optional] The start of the events range. Can be a snapshot index (integer) or a time expression (e.g. NOW, 1hour). |
| `--start-ts`         | float   | \[optional] The start of the events range as a Unix timestamp in seconds (integer or float).                         |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Example

To view a live example of 'kosli log environment' you can run the command below (for the [cyber-dojo](https://app.kosli.com/cyber-dojo) demo organization).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
# The API token below is read-only
export KOSLI_API_TOKEN=Pj_XT2deaVA6V1qrTlthuaWsmjVt4eaHQwqnwqjRO3A
kosli log environment aws-prod --output=json
```

<Accordion title="View example output">
  <div>
    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    [
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5309,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:84e986a@sha256:06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
        "sha256": "06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
        "description": "1 instance changed",
        "reported_at": 1788256325.6192138,
        "pipeline": "saver-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "saver-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "updated-provenance",
        "code_diff": "https://github.com/cyber-dojo/saver/compare/36f0420f728fe61e44a3ab0043cf9a3d70863cad...84e986ad70d32e9be362d5bd9ce7c7af94f6eaab",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/saver-ci/fingerprint/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f",
            "html": "https://app.kosli.com/cyber-dojo/flows/saver-ci/artifacts/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f?artifact_id=a599cb04-5965-46a6-a774-24dc6341"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5309,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:27b3504@sha256:1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
        "sha256": "1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
        "description": "1 instance changed",
        "reported_at": 1788256325.6192138,
        "pipeline": "nginx-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "nginx-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "updated-provenance",
        "code_diff": "https://github.com/cyber-dojo/nginx/compare/fb791742054fa28dd89269aac8002ebfd7b3386e...27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/nginx-ci/fingerprint/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21",
            "html": "https://app.kosli.com/cyber-dojo/flows/nginx-ci/artifacts/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21?artifact_id=9045bb07-ea42-482f-99c3-4fe5b86f"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5309,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:ff9f292@sha256:2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
        "sha256": "2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
        "description": "1 instance changed",
        "reported_at": 1788256325.6192138,
        "pipeline": "dashboard-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "dashboard-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "updated-provenance",
        "code_diff": "https://github.com/cyber-dojo/dashboard/compare/2b300f450f72006f6a9000aaf9cd04485f1e8095...ff9f292e809801d35246183988b7812826bc2760",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/dashboard-ci/fingerprint/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f",
            "html": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/artifacts/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f?artifact_id=aa6c0c1d-2d5d-4c98-9f9d-1160dd2f"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5309,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:a357ebd@sha256:28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
        "sha256": "28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
        "description": "1 instance changed",
        "reported_at": 1788256325.6192138,
        "pipeline": "languages-start-points-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "languages-start-points-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "updated-provenance",
        "code_diff": "https://github.com/cyber-dojo/languages-start-points/compare/068b3424c7da843a4f2d428d2e4915f33efc4a02...a357ebd85acdd54968fa0192405aaf2e289d27c9",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/languages-start-points-ci/fingerprint/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832",
            "html": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci/artifacts/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832?artifact_id=8e028a8d-a1f2-4732-8663-47012b29"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5309,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:b12a5c9@sha256:34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
        "sha256": "34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
        "description": "1 instance changed",
        "reported_at": 1788256325.6192138,
        "pipeline": "custom-start-points-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "custom-start-points-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "updated-provenance",
        "code_diff": "https://github.com/cyber-dojo/custom-start-points/compare/790d86b66f4d86ab47f5c521daf5039dc8aeef4d...b12a5c9b17023462d13e81381a69c7ef05f84dc2",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/custom-start-points-ci/fingerprint/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09",
            "html": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci/artifacts/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09?artifact_id=2aa23627-9e91-488e-b3ea-e4bf2e22"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5309,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:cbe481c@sha256:36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
        "sha256": "36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
        "description": "3 instances changed",
        "reported_at": 1788256325.6192138,
        "pipeline": "web-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "web-ci",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "updated-provenance",
        "code_diff": "https://github.com/cyber-dojo/web/compare/5e4b9873df93525c041c386c06e0ab8fc36b6f33...cbe481c4b842f897e4e9e411cd78461a3a12a334",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/web-ci/fingerprint/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc",
            "html": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc?artifact_id=41957e62-eaad-48d2-af40-46879efb"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5309,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:f22a30e@sha256:41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
        "sha256": "41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
        "description": "1 instance changed",
        "reported_at": 1788256325.6192138,
        "pipeline": "exercises-start-points-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "exercises-start-points-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "updated-provenance",
        "code_diff": "https://github.com/cyber-dojo/exercises-start-points/compare/258b6d07d2b28ad5cb2ce6d29934997f72380f1a...f22a30ed7659b05a88c22e9f22dc2388f2deb8c8",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/exercises-start-points-ci/fingerprint/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6",
            "html": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci/artifacts/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6?artifact_id=aa4300d4-b690-4d71-9596-6af987e1"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5309,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:90c8d98@sha256:6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
        "sha256": "6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
        "description": "1 instance changed",
        "reported_at": 1788256325.6192138,
        "pipeline": "spooler-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "spooler-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "updated-provenance",
        "code_diff": "https://github.com/cyber-dojo/spooler/compare/dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb...90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/spooler-ci/fingerprint/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd",
            "html": "https://app.kosli.com/cyber-dojo/flows/spooler-ci/artifacts/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd?artifact_id=6df79438-91a2-4c2b-a945-52fb5218"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5309,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:d64d2b1@sha256:c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
        "sha256": "c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
        "description": "1 instance changed",
        "reported_at": 1788256325.6192138,
        "pipeline": "creator-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "creator-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "updated-provenance",
        "code_diff": "https://github.com/cyber-dojo/creator/compare/83357f112ef5c10b157cb84732c77965cc8ddc48...d64d2b11879179255f11dc991e81fbaf4a040264",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/creator-ci/fingerprint/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
            "html": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=61384b36-4d32-43f2-8d5d-a72e2e7e"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5308,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:bcac1c1@sha256:03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
        "sha256": "03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
        "description": "1 instance changed",
        "reported_at": 1788256258.609352,
        "pipeline": "differ-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "differ-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "updated-provenance",
        "code_diff": "https://github.com/cyber-dojo/differ/compare/108cccf9bccf9af5d455db66c250480b53cbecc7...bcac1c18385b2573ef6c6e8eeae0f62ed14a03de",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/differ-ci/fingerprint/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab",
            "html": "https://app.kosli.com/cyber-dojo/flows/differ-ci/artifacts/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab?artifact_id=11345222-f37a-4f8d-8051-ec26a321"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5308",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5308"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5308,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:ca65b67@sha256:a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
        "sha256": "a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
        "description": "3 instances changed",
        "reported_at": 1788256258.609352,
        "pipeline": "runner-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "runner-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "updated-provenance",
        "code_diff": "https://github.com/cyber-dojo/runner/compare/976b63e8001ec7441ebc7737ca69f620d47e7ffe...ca65b67c3e311fbdd2435609fdb6f8a5479f66f9",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/runner-ci/fingerprint/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638",
            "html": "https://app.kosli.com/cyber-dojo/flows/runner-ci/artifacts/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638?artifact_id=3b03ceaf-96a6-4afa-8aa2-179e5fe9"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5308",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5308"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5307,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:83357f1@sha256:adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b",
        "sha256": "adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b",
        "description": "1 instance stopped running (from 1 to 0)",
        "reported_at": 1788256138.680238,
        "pipeline": "creator-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "creator-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "exited",
        "code_diff": "https://github.com/cyber-dojo/creator/compare/89019f6d8059406e56fa499b2dec2dbf93f4d5c7...83357f112ef5c10b157cb84732c77965cc8ddc48",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/creator-ci/fingerprint/adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b",
            "html": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b?artifact_id=11539f6a-befb-4b79-9484-fd9f25d3"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5307",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5307"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5306,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:d64d2b1@sha256:c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
        "sha256": "c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
        "description": "1 instance started running (from 0 to 1)",
        "reported_at": 1788256078.451175,
        "pipeline": "creator-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "creator-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "started-compliant",
        "code_diff": "https://github.com/cyber-dojo/creator/compare/83357f112ef5c10b157cb84732c77965cc8ddc48...d64d2b11879179255f11dc991e81fbaf4a040264",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/creator-ci/fingerprint/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab",
            "html": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=61384b36-4d32-43f2-8d5d-a72e2e7e"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5306",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5306"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5305,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:976b63e@sha256:01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9",
        "sha256": "01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9",
        "description": "1 instance stopped running (from 1 to 0)",
        "reported_at": 1788255898.5005004,
        "pipeline": "runner-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "runner-ci",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "exited",
        "code_diff": "https://github.com/cyber-dojo/runner/compare/d7541d3fb2c548bd68a81f812b5a6c95fcf9a1bd...976b63e8001ec7441ebc7737ca69f620d47e7ffe",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/runner-ci/fingerprint/01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9",
            "html": "https://app.kosli.com/cyber-dojo/flows/runner-ci/artifacts/01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9?artifact_id=e63d6d6b-d7ee-4fad-a66a-32a4ebba"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5305",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5305"
          }
        }
      },
      {
        "environment_name": "aws-prod",
        "snapshot_index": 5304,
        "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:108cccf@sha256:31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac",
        "sha256": "31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac",
        "description": "1 instance stopped running (from 1 to 0)",
        "reported_at": 1788255838.4418423,
        "pipeline": "differ-ci",
        "deployments": [],
        "flows": [
          {
            "flow_name": "differ-ci",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-beta-per-artifact",
            "deployments": null
          },
          {
            "flow_name": "production-promotion",
            "deployments": null
          },
          {
            "flow_name": "snyk-aws-prod-per-artifact",
            "deployments": null
          }
        ],
        "artifact_compliance": true,
        "snapshot_compliance": true,
        "type": "exited",
        "code_diff": "https://github.com/cyber-dojo/differ/compare/10e162d4e1294815375a31121f14d57e13183b34...108cccf9bccf9af5d455db66c250480b53cbecc7",
        "_links": {
          "artifact": {
            "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/differ-ci/fingerprint/31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac",
            "html": "https://app.kosli.com/cyber-dojo/flows/differ-ci/artifacts/31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac?artifact_id=50b8cff6-1888-4c76-b31a-fdd7a311"
          },
          "snapshot": {
            "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5304",
            "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5304"
          }
        }
      }
    ]
    ```
  </div>
</Accordion>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="list the last 15 events for an environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli log environment yourEnvironmentName 

    ```
  </Accordion>

  <Accordion title="list the last 30 events for an environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli log environment yourEnvironmentName 
    	--page-limit 30 

    ```
  </Accordion>

  <Accordion title="list the last 30 events for an environment (in JSON)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli log environment yourEnvironmentName 
    	--page-limit 30 
    	--output json

    ```
  </Accordion>

  <Accordion title="list events for an environment filtered by repo">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli log environment yourEnvironmentName 
    	--repo yourOrg/yourRepo 

    ```
  </Accordion>

  <Accordion title="list events for an environment filtered by multiple repos">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli log environment yourEnvironmentName 
    	--repo yourOrg/yourRepo1 
    	--repo yourOrg/yourRepo2 

    ```
  </Accordion>

  <Accordion title="list events starting from snapshot 5">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli log environment yourEnvironmentName 
    	--start 5 

    ```
  </Accordion>

  <Accordion title="list events between two time expressions">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli log environment yourEnvironmentName 
    	--start 1hour 
    	--end NOW 

    ```
  </Accordion>

  <Accordion title="list events between two Unix timestamps">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli log environment yourEnvironmentName 
    	--start-ts 1700000000 
    	--end-ts 1700086400 
    ```
  </Accordion>
</AccordionGroup>


# kosli rename environment
Source: https://docs.kosli.com/client_reference/kosli_rename_environment

Rename a Kosli environment.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli rename environment OLD_NAME NEW_NAME [flags]
```

Rename a Kosli environment.
The environment will remain accessible under its old name until that name is taken by another environment.

## Flags

| Flag              | Type | Description                                                                                                                          |
| :---------------- | :--- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool | help for environment                                                                                                                 |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="rename a Kosli environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli rename environment oldName newName 
    ```
  </Accordion>
</AccordionGroup>


# kosli rename flow
Source: https://docs.kosli.com/client_reference/kosli_rename_flow

Rename a Kosli flow.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli rename flow OLD_NAME NEW_NAME [flags]
```

Rename a Kosli flow.
The flow will remain accessible under its old name until that name is taken by another flow.

## Flags

| Flag              | Type | Description                                                                                                                          |
| :---------------- | :--- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool | help for flow                                                                                                                        |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="rename a Kosli flow">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli rename flow oldName newName 
    ```
  </Accordion>
</AccordionGroup>


# kosli report artifact
Source: https://docs.kosli.com/client_reference/kosli_report_artifact

Report an artifact creation to a Kosli flow.  

<Warning>
  This command is deprecated. Deprecated commands will be removed in a future
  release.
</Warning>

see kosli attest commands

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli report artifact {IMAGE-NAME | FILE-PATH | DIR-PATH} [flags]
```

Report an artifact creation to a Kosli flow.

The artifact fingerprint can be provided directly with the `--fingerprint` flag, or
calculated based on `--artifact-type` flag.

Artifact type can be one of: "file" for files, "dir" for directories, "oci" for container
images in registries or "docker" for local docker images.

Note: `--artifact-type=docker` reads the image's repo digest via the local Docker daemon.
The image must have been pushed to or pulled from a registry for a repo digest to exist;
a freshly built image (just `docker build`) will not have one. If the image is already in
a registry, prefer `--artifact-type=oci`, which fetches the digest directly from the
registry without needing a local Docker daemon.

For `--artifact-type=oci` (and for `--artifact-type=docker` when `--registry-username`
is set), registry credentials are resolved as follows:

1. If `--registry-username` (and optionally `--registry-password`) is set, it is used directly.
2. Otherwise, credentials are discovered automatically from:
   * the Docker config file (`~/.docker/config.json`, populated by `docker login`)
   * the Podman/containers auth file (`~/.config/containers/auth.json`, or `$REGISTRY_AUTH_FILE`)
   * any Docker credential helper configured in that config (e.g. `docker-credential-ecr-login`
     for AWS ECR, `docker-credential-gcloud` for GCR/Artifact Registry, an ACR helper for Azure,
     or a local keychain helper), invoked as an external binary on `$PATH`
   * if none of the above yield credentials, the registry is accessed anonymously, which works
     for public images
     `--registry-provider` is deprecated and no longer used.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

## Flags

| Flag                    | Type    | Description                                                                                                                                                                                                                                            |
| :---------------------- | :------ | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-t`, `--artifact-type` | string  | The type of the artifact to calculate its SHA256 fingerprint. One of: \[oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it).       |
| `-b`, `--build-url`     | string  | The url of CI pipeline that built the artifact. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                                                 |
| `-u`, `--commit-url`    | string  | The url for the git commit that created the artifact. (defaulted in some CIs: [docs](/integrations/ci_cd) ).                                                                                                                                           |
| `-D`, `--dry-run`       | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                   |
| `-x`, `--exclude`       | strings | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. Only applicable for `--artifact-type` dir.                                                                                       |
| `-F`, `--fingerprint`   | string  | \[conditional] The SHA256 fingerprint of the artifact. Only required if you don't specify '`--artifact-type`'.                                                                                                                                         |
| `-f`, `--flow`          | string  | The Kosli flow name.                                                                                                                                                                                                                                   |
| `-g`, `--git-commit`    | string  | \[defaulted] The git commit from which the artifact was created. (defaulted in some CIs: [docs](/integrations/ci_cd), otherwise defaults to HEAD ).                                                                                                    |
| `-h`, `--help`          | bool    | help for artifact                                                                                                                                                                                                                                      |
| `-n`, `--name`          | string  | \[optional] Artifact display name, if different from file, image or directory name.                                                                                                                                                                    |
| `--registry-password`   | string  | \[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
| `--registry-provider`   | string  | \[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry. (DEPRECATED: no longer used)                                                                            |
| `--registry-username`   | string  | \[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.                 |
| `--repo-root`           | string  | \[defaulted] The directory where the source git repository is available. (default ".")                                                                                                                                                                 |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="Report to a Kosli flow that a file type artifact has been created">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli report artifact FILE.tgz 
    	--artifact-type file 
    	--build-url https://exampleci.com 
    	--commit-url https://github.com/YourOrg/YourProject/commit/yourCommitShaThatThisArtifactWasBuiltFrom 
    	--git-commit yourCommitShaThatThisArtifactWasBuiltFrom 

    ```
  </Accordion>

  <Accordion title="Report to a Kosli flow that an artifact with a provided fingerprint (sha256) has been created">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli report artifact ANOTHER_FILE.txt 
    	--build-url https://exampleci.com 
    	--commit-url https://github.com/YourOrg/YourProject/commit/yourCommitShaThatThisArtifactWasBuiltFrom 
    	--git-commit yourCommitShaThatThisArtifactWasBuiltFrom 
    	--fingerprint yourArtifactFingerprint
    ```
  </Accordion>
</AccordionGroup>


# kosli rotate api-key
Source: https://docs.kosli.com/client_reference/kosli_rotate_api-key

Rotate one or more API keys for a service account.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli rotate api-key KEY-ID [KEY-ID...] [flags]
```

Rotate one or more API keys for a service account.

A new API key is generated immediately. The old key remains valid for a grace period to
allow time to update dependent systems; the length of that grace period is server-managed
unless overridden with `--grace-period-hours`. The new key value is only returned once, so
make sure to store it securely.

## Flags

| Flag                         | Type   | Description                                                                                                                                                          |
| :--------------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run`            | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                 |
| `-e`, `--expires-at`         | string | \[optional] When the API key expires. Accepts an epoch timestamp or a date like '2026-06-04', '2026-06-04 15:04:05', or an RFC3339 timestamp. Defaults to no expiry. |
| `-g`, `--grace-period-hours` | int    | \[optional] How many hours the old API key remains valid after rotation, to allow time to update dependent systems. Defaults to the server-side value when not set.  |
| `-h`, `--help`               | bool   | help for api-key                                                                                                                                                     |
| `-o`, `--output`             | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table")                                                                          |
| `-s`, `--service-account`    | string | The name of the service account whose API keys are managed.                                                                                                          |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="rotate an API key for a service account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli rotate api-key yourApiKeyID 
    	--service-account yourServiceAccountName 

    ```
  </Accordion>

  <Accordion title="rotate multiple API keys at once">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli rotate api-key keyID1 keyID2 
    	--service-account yourServiceAccountName 

    ```
  </Accordion>

  <Accordion title="rotate an API key, keeping the old key valid for 48 hours">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli rotate api-key yourApiKeyID 
    	--grace-period-hours 48 
    	--service-account yourServiceAccountName 
    ```
  </Accordion>
</AccordionGroup>


# kosli search
Source: https://docs.kosli.com/client_reference/kosli_search

Search for a git commit or an artifact fingerprint in Kosli.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli search {GIT-COMMIT | FINGERPRINT} [flags]
```

Search for a git commit or an artifact fingerprint in Kosli.\
You can use short git commit or artifact fingerprint shas, but you must provide at least 5 characters.

## Flags

| Flag             | Type   | Description                                                                                 |
| :--------------- | :----- | :------------------------------------------------------------------------------------------ |
| `-h`, `--help`   | bool   | help for search                                                                             |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="Search for a git commit in Kosli">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli search YOUR_GIT_COMMIT 

    ```
  </Accordion>

  <Accordion title="Search for an artifact fingerprint in Kosli">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli search YOUR_ARTIFACT_FINGERPRINT 
    ```
  </Accordion>
</AccordionGroup>


# kosli snapshot azure
Source: https://docs.kosli.com/client_reference/kosli_snapshot_azure

Report a snapshot of running Azure web apps and function apps in an Azure resource group to Kosli.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli snapshot azure ENVIRONMENT-NAME [flags]
```

Report a snapshot of running Azure web apps and function apps in an Azure resource group to Kosli.\
The reported data includes Azure app names, container image digests and creation timestamps.

For Azure Function apps or Web apps which uses zip deployment the fingerprint is calculated based on the
content of the zip file. This is the same as unzipping the file and then running `kosli fingerprint -t dir yourDirName`.
When doing zip deployment the WEBSITE\_RUN\_FROM\_PACKAGE must NOT be set to 1. This will cause the azure
API calls to not return the content of what is running on the server and fingerprint calculations
will not match. See
[https://learn.microsoft.com/en-us/azure/azure-functions/functions-app-settings#website\_run\_from\_package](https://learn.microsoft.com/en-us/azure/azure-functions/functions-app-settings#website_run_from_package)

For zip-deployed apps, the fingerprint respects a `.kosli_ignore` file at the root of the deployed package.
To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

To authenticate to Azure, you need to create Azure service principal with a secret
and provide these Azure credentials via flags or by exporting the equivalent KOSLI env vars (e.g. KOSLI\_AZURE\_CLIENT\_ID).
The service principal needs to have the following permissions:

1. Microsoft.Web/sites/Read
2. Microsoft.ContainerRegistry/registries/pull/read

## Flags

| Flag                          | Type   | Description                                                                                                                          |
| :---------------------------- | :----- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `--azure-client-id`           | string | Azure client ID.                                                                                                                     |
| `--azure-client-secret`       | string | Azure client secret.                                                                                                                 |
| `--azure-resource-group-name` | string | Azure resource group name.                                                                                                           |
| `--azure-subscription-id`     | string | Azure subscription ID.                                                                                                               |
| `--azure-tenant-id`           | string | Azure tenant ID.                                                                                                                     |
| `--digests-source`            | string | \[defaulted] Where to get the digests from. Valid values are 'acr' and 'logs'. (default "acr")                                       |
| `-D`, `--dry-run`             | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`                | bool   | help for azure                                                                                                                       |
| `--zip`                       | bool   | Download logs from Azure as zip files                                                                                                |

## Flags inherited from parent commands

| Flag                        | Type   | Description                                                                                                                                                                                                                                              |
| :-------------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-a`, `--api-token`         | string | The Kosli API token.                                                                                                                                                                                                                                     |
| `-A`, `--auto-environment`  | bool   | \[optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot.                                                                                                    |
| `-c`, `--config-file`       | string | \[optional] The Kosli config file path. (default "kosli")                                                                                                                                                                                                |
| `--debug`                   | bool   | \[optional] Print debug logs to stdout.                                                                                                                                                                                                                  |
| `--environment-description` | string | \[optional] The environment description.                                                                                                                                                                                                                 |
| `--exclude-scaling`         | bool   | \[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) |
| `-H`, `--host`              | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                                                                                                                              |
| `--http-proxy`              | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                                                                                                                              |
| `--include-scaling`         | bool   | \[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)     |
| `-r`, `--max-api-retries`   | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                                                                                                                  |
| `--org`                     | string | The Kosli organization.                                                                                                                                                                                                                                  |
| `-q`, `--quiet`             | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins.                                                                                                  |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="Use Azure Container Registry to get the digests for artifacts in a snapshot">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot azure yourEnvironmentName 
    	--azure-client-id yourAzureClientID 
    	--azure-client-secret yourAzureClientSecret 
    	--azure-tenant-id yourAzureTenantID 
    	--azure-subscription-id yourAzureSubscriptionID 
    	--azure-resource-group-name yourAzureResourceGroupName 
    	--digests-source acr 

    ```
  </Accordion>

  <Accordion title="Use Docker logs of Azure apps to get the digests for artifacts in a snapshot">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot azure yourEnvironmentName 
    	--azure-client-id yourAzureClientID 
    	--azure-client-secret yourAzureClientSecret 
    	--azure-tenant-id yourAzureTenantID 
    	--azure-subscription-id yourAzureSubscriptionID 
    	--azure-resource-group-name yourAzureResourceGroupName 
    	--digests-source logs 

    ```
  </Accordion>

  <Accordion title="Report digest of an Azure Function app">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot azure yourEnvironmentName 
    	--azure-client-id yourAzureClientID 
    	--azure-client-secret yourAzureClientSecret 
    	--azure-tenant-id yourAzureTenantID 
    	--azure-subscription-id yourAzureSubscriptionID 
    	--azure-resource-group-name yourAzureResourceGroupName 
    ```
  </Accordion>
</AccordionGroup>


# kosli snapshot cloud-run
Source: https://docs.kosli.com/client_reference/kosli_snapshot_cloud-run

Report a snapshot of Cloud Run services and jobs in a Google Cloud project and region to Kosli.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli snapshot cloud-run ENVIRONMENT-NAME [flags]
```

Report a snapshot of Cloud Run services and jobs in a Google Cloud project and region to Kosli.\
Coverage:

| Deploy method                                | Container?                           | Reported | Notes                               |
| -------------------------------------------- | ------------------------------------ | -------- | ----------------------------------- |
| Cloud Run service (image-deployed)           | Yes                                  | ✓ Full   |                                     |
| Cloud Run service (source / Buildpacks)      | Yes (built for you)                  | ✓ Full   |                                     |
| Cloud Run Job                                | Yes                                  | ✓ Full   |                                     |
| Cloud Run function (Cloud Functions 2nd gen) | Yes (Buildpacks)                     | ✓ Full   |                                     |
| Cloud Functions 1st gen                      | No (Google packages the source)      | ✗        |                                     |
| App Engine Standard                          | No (gVisor sandbox, not a container) | ✗        | Not currently supported in the CLI. |
| App Engine Flexible                          | Yes (containers on managed VMs)      | ✗        |                                     |
| GKE (Standard / Autopilot)                   | Yes                                  | ✗        | Use `kosli snapshot k8s` instead.   |
| Cloud Run for Anthos                         | Yes (knative on GKE)                 | ✗        |                                     |
| Compute Engine + Container-Optimized OS      | Yes (Docker on a VM)                 | ✗        |                                     |

Each Cloud Run service contributes one artifact per revision in its traffic
configuration. Each Cloud Run Job contributes one artifact, identified by the
image bound to the Job (Jobs do not have a revision/traffic-split model).
Idle Jobs (no currently-running Execution) are included.

GCP authentication uses Application Default Credentials. On a developer
machine, run `gcloud auth application-default login`; in GCE/GKE/Cloud Run
the metadata server / Workload Identity is used automatically. The caller
needs `roles/run.viewer` on the target project, plus
`roles/artifactregistry.reader` on the Artifact Registry repository (or the
project) for digest and tag resolution on tag-pinned images. Missing the AR
role is non-fatal — tag-pinned artifacts then surface with empty digests.

Digest and tag resolution is scoped to Artifact Registry (`*-docker.pkg.dev`)
and the legacy Container Registry (`*.gcr.io`). Images from other registries
(Docker Hub, Quay, ECR, etc.) are reported as-is.

Skip all filtering flags to report every service and every job in the given
project + region. Use `--include` and/or `--include-regex` to snapshot only a
subset, OR `--exclude` and/or `--exclude-regex` to omit a subset; include and
exclude are mutually exclusive. Filters apply uniformly to both service and
job names and are case-sensitive.

Pass `--resolve-names` to rewrite digest-pinned Service artifact names back
to their deploy-time tags (commit SHA / version) via an Artifact Registry
reverse-lookup. Only supported for Artifact Registry hosts.

## Flags

| Flag              | Type    | Description                                                                                                                                                                                                                                                                                                                 |
| :---------------- | :------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                                                                                        |
| `--exclude`       | strings | \[optional] The comma-separated list of Cloud Run service or job names to exclude. Can't be used together with `--include` or `--include-regex`.                                                                                                                                                                            |
| `--exclude-regex` | strings | \[optional] The comma-separated list of Cloud Run service or job name regex patterns to exclude. Can't be used together with `--include` or `--include-regex`.                                                                                                                                                              |
| `-h`, `--help`    | bool    | help for cloud-run                                                                                                                                                                                                                                                                                                          |
| `--include`       | strings | \[optional] The comma-separated list of Cloud Run service or job names to snapshot. Can't be used together with `--exclude` or `--exclude-regex`.                                                                                                                                                                           |
| `--include-regex` | strings | \[optional] The comma-separated list of Cloud Run service or job name regex patterns to snapshot. Can't be used together with `--exclude` or `--exclude-regex`.                                                                                                                                                             |
| `--project`       | string  | \[required] GCP project ID.                                                                                                                                                                                                                                                                                                 |
| `--region`        | string  | \[required] GCP region (e.g. europe-west1).                                                                                                                                                                                                                                                                                 |
| `--resolve-names` | bool    | \[optional] When set, resolve digest-pinned artifact names back to their deploy-time tags (commit SHA / version) via an Artifact Registry reverse-lookup. Requires roles/artifactregistry.reader. Default: artifacts keep whatever name the Cloud Run API returned (digest-pinned for Services, deploy-time form for Jobs). |

## Flags inherited from parent commands

| Flag                        | Type   | Description                                                                                                                                                                                                                                              |
| :-------------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-a`, `--api-token`         | string | The Kosli API token.                                                                                                                                                                                                                                     |
| `-A`, `--auto-environment`  | bool   | \[optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot.                                                                                                    |
| `-c`, `--config-file`       | string | \[optional] The Kosli config file path. (default "kosli")                                                                                                                                                                                                |
| `--debug`                   | bool   | \[optional] Print debug logs to stdout.                                                                                                                                                                                                                  |
| `--environment-description` | string | \[optional] The environment description.                                                                                                                                                                                                                 |
| `--exclude-scaling`         | bool   | \[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) |
| `-H`, `--host`              | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                                                                                                                              |
| `--http-proxy`              | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                                                                                                                              |
| `--include-scaling`         | bool   | \[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)     |
| `-r`, `--max-api-retries`   | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                                                                                                                  |
| `--org`                     | string | The Kosli organization.                                                                                                                                                                                                                                  |
| `-q`, `--quiet`             | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins.                                                                                                  |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report every Cloud Run service and job in a project + region">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot cloud-run yourEnvironmentName 
    	--project yourGCPProject 
    	--region yourGCPRegion 

    ```
  </Accordion>

  <Accordion title="report only the named services and jobs">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot cloud-run yourEnvironmentName 
    	--project yourGCPProject 
    	--region yourGCPRegion 
    	--include hello-world,sandman-job 

    ```
  </Accordion>

  <Accordion title="report everything except the kosli-reporter job (the Job that runs this command)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot cloud-run yourEnvironmentName 
    	--project yourGCPProject 
    	--region yourGCPRegion 
    	--exclude kosli-reporter 
    ```
  </Accordion>
</AccordionGroup>


# kosli snapshot docker
Source: https://docs.kosli.com/client_reference/kosli_snapshot_docker

Report a snapshot of running containers from docker host to Kosli.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli snapshot docker ENVIRONMENT-NAME [flags]
```

Report a snapshot of running containers from docker host to Kosli.\
The reported data includes container image digests
and creation timestamps. Containers running images which have not
been pushed to or pulled from a registry will be ignored.

## Flags

| Flag              | Type | Description                                                                                                                          |
| :---------------- | :--- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool | help for docker                                                                                                                      |

## Flags inherited from parent commands

| Flag                        | Type   | Description                                                                                                                                                                                                                                              |
| :-------------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-a`, `--api-token`         | string | The Kosli API token.                                                                                                                                                                                                                                     |
| `-A`, `--auto-environment`  | bool   | \[optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot.                                                                                                    |
| `-c`, `--config-file`       | string | \[optional] The Kosli config file path. (default "kosli")                                                                                                                                                                                                |
| `--debug`                   | bool   | \[optional] Print debug logs to stdout.                                                                                                                                                                                                                  |
| `--environment-description` | string | \[optional] The environment description.                                                                                                                                                                                                                 |
| `--exclude-scaling`         | bool   | \[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) |
| `-H`, `--host`              | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                                                                                                                              |
| `--http-proxy`              | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                                                                                                                              |
| `--include-scaling`         | bool   | \[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)     |
| `-r`, `--max-api-retries`   | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                                                                                                                  |
| `--org`                     | string | The Kosli organization.                                                                                                                                                                                                                                  |
| `-q`, `--quiet`             | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins.                                                                                                  |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report what is running in a docker host">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot docker yourEnvironmentName 

    ```
  </Accordion>

  <Accordion title="report a docker snapshot, creating the environment first if it does not exist">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot docker yourEnvironmentName 
    	--auto-environment 
    	--environment-description "Production docker host" 
    ```
  </Accordion>
</AccordionGroup>


# kosli snapshot ecs
Source: https://docs.kosli.com/client_reference/kosli_snapshot_ecs

Report a snapshot of running containers in one or more AWS ECS cluster(s) to Kosli.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli snapshot ecs ENVIRONMENT-NAME [flags]
```

Report a snapshot of running containers in one or more AWS ECS cluster(s) to Kosli.\
Skip all filtering flags to report everything running in all clusters in a given AWS account.

Use `--clusters` and/or `--clusters-regex` OR `--exclude` and/or `--exclude-regex` to filter the clusters to snapshot.
You can also filter the services within a cluster using `--services` and/or `--services-regex`. Or use `--exclude-services` and/or `--exclude-services-regex` to exclude some services.
Note that service filtering is applied to all clusters being snapshot.

All filtering options are case-sensitive.

The reported data includes cluster and service names, container image digests and creation timestamps.

To authenticate to AWS, you can either:

1. provide the AWS static credentials via flags or by exporting the equivalent KOSLI env vars (e.g. KOSLI\_AWS\_KEY\_ID)
2. export the AWS env vars (e.g. AWS\_ACCESS\_KEY\_ID).
3. Use a shared config/credentials file under the \$HOME/.aws

Option 1 takes highest precedence, while option 3 is the lowest.
More details can be found here: [https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specifying-credentials](https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specifying-credentials)

## Flags

| Flag                       | Type    | Description                                                                                                                                                          |
| :------------------------- | :------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--aws-key-id`             | string  | The AWS access key ID.                                                                                                                                               |
| `--aws-region`             | string  | The AWS region.                                                                                                                                                      |
| `--aws-secret-key`         | string  | The AWS secret access key.                                                                                                                                           |
| `-C`, `--cluster`          | strings | The name of the ECS cluster. (DEPRECATED: use `--clusters` instead)                                                                                                  |
| `--clusters`               | strings | \[optional] The comma-separated list of ECS cluster names to snapshot. Can't be used together with `--exclude` or `--exclude-regex`.                                 |
| `--clusters-regex`         | strings | \[optional] The comma-separated list of ECS cluster name regex patterns to snapshot. Can't be used together with `--exclude` or `--exclude-regex`.                   |
| `-D`, `--dry-run`          | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                 |
| `--exclude`                | strings | \[optional] The comma-separated list of ECS cluster names to exclude. Can't be used together with `--clusters` or `--clusters-regex`.                                |
| `--exclude-regex`          | strings | \[optional] The comma-separated list of ECS cluster name regex patterns to exclude. Can't be used together with `--clusters` or `--clusters-regex`.                  |
| `--exclude-services`       | strings | \[optional] The comma-separated list of ECS service names to exclude. Can't be used together with `--services` or `--services-regex`.                                |
| `--exclude-services-regex` | strings | \[optional] The comma-separated list of ECS service name regex patterns to exclude. Can't be used together with `--services` or `--services-regex`.                  |
| `-h`, `--help`             | bool    | help for ecs                                                                                                                                                         |
| `-s`, `--service-name`     | string  | \[deprecated] The name of the ECS service. Use `--services` instead. (DEPRECATED: it will be removed in a future release)                                            |
| `--services`               | strings | \[optional] The comma-separated list of ECS service names to snapshot. Can't be used together with `--exclude-services` or `--exclude-services-regex`.               |
| `--services-regex`         | strings | \[optional] The comma-separated list of ECS service name regex patterns to snapshot. Can't be used together with `--exclude-services` or `--exclude-services-regex`. |

## Flags inherited from parent commands

| Flag                        | Type   | Description                                                                                                                                                                                                                                              |
| :-------------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-a`, `--api-token`         | string | The Kosli API token.                                                                                                                                                                                                                                     |
| `-A`, `--auto-environment`  | bool   | \[optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot.                                                                                                    |
| `-c`, `--config-file`       | string | \[optional] The Kosli config file path. (default "kosli")                                                                                                                                                                                                |
| `--debug`                   | bool   | \[optional] Print debug logs to stdout.                                                                                                                                                                                                                  |
| `--environment-description` | string | \[optional] The environment description.                                                                                                                                                                                                                 |
| `--exclude-scaling`         | bool   | \[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) |
| `-H`, `--host`              | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                                                                                                                              |
| `--http-proxy`              | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                                                                                                                              |
| `--include-scaling`         | bool   | \[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)     |
| `-r`, `--max-api-retries`   | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                                                                                                                  |
| `--org`                     | string | The Kosli organization.                                                                                                                                                                                                                                  |
| `-q`, `--quiet`             | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins.                                                                                                  |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="authentication to AWS using flags">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs yourEnvironmentName 
    	--aws-key-id yourAWSAccessKeyID 
    	--aws-secret-key yourAWSSecretAccessKey 
    	--aws-region yourAWSRegion 

    ```
  </Accordion>

  <Accordion title="authentication to AWS using env variables">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export AWS_ACCESS_KEY_ID=yourAWSAccessKeyID
    export AWS_SECRET_ACCESS_KEY=yourAWSSecretAccessKey
    export AWS_REGION=yourAWSRegion

    kosli snapshot ecs yourEnvironmentName 

    ```
  </Accordion>

  <Accordion title="reporting everything running in all clusters in a given AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env 

    ```
  </Accordion>

  <Accordion title="include clusters matching a name in the AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --clusters my-cluster ...

    ```
  </Accordion>

  <Accordion title="include clusters matching a pattern in the AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --clusters-regex "^my-cluster-.*" ...

    ```
  </Accordion>

  <Accordion title="include clusters matching a list of names in the AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --clusters my-cluster1,my-cluster2 ...

    ```
  </Accordion>

  <Accordion title="exclude clusters matching a name in the AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --exclude my-cluster ...

    ```
  </Accordion>

  <Accordion title="exclude clusters matching a pattern in the AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --exclude-regex "^my-cluster-.*" ...

    ```
  </Accordion>

  <Accordion title="exclude clusters matching a list of names in the AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --exclude my-cluster1,my-cluster2 ...

    ```
  </Accordion>

  <Accordion title="include Services matching a name in one cluster">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --clusters my-cluster --services backend-app ...

    ```
  </Accordion>

  <Accordion title="include Services matching a pattern in one cluster">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --clusters my-cluster --services-regex "^backend-.*" ...

    ```
  </Accordion>

  <Accordion title="include production Services only (by naming convention) in all clusters in the AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --services-regex ".*-prod-.*" ...

    ```
  </Accordion>

  <Accordion title="include Services matching a name in all clusters in the AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --services backend-app ...

    ```
  </Accordion>

  <Accordion title="include Services matching a list of names in all clusters in the AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --services backend-app,frontend-app ...

    ```
  </Accordion>

  <Accordion title="exclude Services matching a pattern in one cluster">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --clusters my-cluster --exclude-services-regex "^backend-.*" ...

    ```
  </Accordion>

  <Accordion title="exclude Production services only (by naming convention)  in all clusters in the AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --exclude-services-regex ".*-prod-.*" ...

    ```
  </Accordion>

  <Accordion title="exclude Services matching a name in one cluster">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --clusters my-cluster --exclude-services backend-app ...

    ```
  </Accordion>

  <Accordion title="exclude Services matching a name in all clusters in the AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --exclude-services backend-app ...

    ```
  </Accordion>

  <Accordion title="exclude Services matching a list of names in all clusters in the AWS account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs my-env --exclude-services backend-app,frontend-app ...
    ```
  </Accordion>
</AccordionGroup>


# kosli snapshot k8s
Source: https://docs.kosli.com/client_reference/kosli_snapshot_k8s

Report a snapshot of running pods in a K8S cluster or namespace(s) to Kosli.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli snapshot k8s ENVIRONMENT-NAME [flags]
```

Report a snapshot of running pods in a K8S cluster or namespace(s) to Kosli.\
Skip `--namespaces` and `--namespaces-regex` to report all pods in all namespaces in a cluster.
The reported data includes pod container images digests and creation timestamps. You can customize the scope of reporting
to include or exclude namespaces.

## Flags

| Flag                         | Type    | Description                                                                                                                                                                                                                                          |
| :--------------------------- | :------ | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--config-file`              | string  | \[optional] The path to a YAML config file that maps multiple Kosli environments to namespace selectors. Cannot be used with a positional environment name argument or namespace flags.                                                              |
| `-D`, `--dry-run`            | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                 |
| `-x`, `--exclude-namespaces` | strings | \[optional] The comma separated list of namespaces names to exclude from reporting artifacts info from. Requires cluster-wide read permissions for pods and namespaces. Can't be used together with `--namespaces` or `--namespaces-regex`.          |
| `--exclude-namespaces-regex` | strings | \[optional] The comma separated list of namespaces regex patterns to exclude from reporting artifacts info from. Requires cluster-wide read permissions for pods and namespaces. Can't be used together with `--namespaces` or `--namespaces-regex`. |
| `-h`, `--help`               | bool    | help for k8s                                                                                                                                                                                                                                         |
| `-k`, `--kubeconfig`         | string  | \[defaulted] The kubeconfig path for the target cluster. (default "\$HOME/.kube/config")                                                                                                                                                             |
| `-n`, `--namespaces`         | strings | \[optional] The comma separated list of namespaces names to report artifacts info from. Can't be used together with `--exclude-namespaces` or `--exclude-namespaces-regex`.                                                                          |
| `--namespaces-regex`         | strings | \[optional] The comma separated list of namespaces regex patterns to report artifacts info from. Requires cluster-wide read permissions for pods and namespaces. Can't be used together with `--exclude-namespaces` `--exclude-namespaces-regex`.    |

## Flags inherited from parent commands

| Flag                        | Type   | Description                                                                                                                                                                                                                                              |
| :-------------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-a`, `--api-token`         | string | The Kosli API token.                                                                                                                                                                                                                                     |
| `-A`, `--auto-environment`  | bool   | \[optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot.                                                                                                    |
| `--debug`                   | bool   | \[optional] Print debug logs to stdout.                                                                                                                                                                                                                  |
| `--environment-description` | string | \[optional] The environment description.                                                                                                                                                                                                                 |
| `--exclude-scaling`         | bool   | \[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) |
| `-H`, `--host`              | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                                                                                                                              |
| `--http-proxy`              | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                                                                                                                              |
| `--include-scaling`         | bool   | \[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)     |
| `-r`, `--max-api-retries`   | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                                                                                                                  |
| `--org`                     | string | The Kosli organization.                                                                                                                                                                                                                                  |
| `-q`, `--quiet`             | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins.                                                                                                  |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report what is running in an entire cluster using kubeconfig at $HOME/.kube/config">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot k8s yourEnvironmentName 

    ```
  </Accordion>

  <Accordion title="report what is running in an entire cluster using kubeconfig at $HOME/.kube/config (with global flags defined in environment or in a config file)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export KOSLI_API_TOKEN=yourAPIToken
    export KOSLI_ORG=yourOrgName

    kosli snapshot k8s yourEnvironmentName

    ```
  </Accordion>

  <Accordion title="report what is running in an entire cluster excluding some namespaces using kubeconfig at $HOME/.kube/config">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot k8s yourEnvironmentName 
        --exclude-namespaces kube-system,utilities 

    ```
  </Accordion>

  <Accordion title="report what is running in a given namespace in the cluster using kubeconfig at $HOME/.kube/config">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot k8s yourEnvironmentName 
    	--namespaces your-namespace 

    ```
  </Accordion>

  <Accordion title="report what is running in a cluster using kubeconfig at a custom path">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot k8s yourEnvironmentName 
    	--kubeconfig /path/to/kube/config 
    ```
  </Accordion>
</AccordionGroup>


# kosli snapshot lambda
Source: https://docs.kosli.com/client_reference/kosli_snapshot_lambda

Report a snapshot of artifacts deployed as one or more AWS Lambda functions and their digests to Kosli.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli snapshot lambda ENVIRONMENT-NAME [flags]
```

Report a snapshot of artifacts deployed as one or more AWS Lambda functions and their digests to Kosli.\
Skip `--function-names` and `--function-names-regex` to report all functions in a given AWS account. Or use `--exclude` and/or `--exclude-regex` to report all functions excluding some.

To authenticate to AWS, you can either:

1. provide the AWS static credentials via flags or by exporting the equivalent KOSLI env vars (e.g. KOSLI\_AWS\_KEY\_ID)
2. export the AWS env vars (e.g. AWS\_ACCESS\_KEY\_ID).
3. Use a shared config/credentials file under the \$HOME/.aws

Option 1 takes highest precedence, while option 3 is the lowest.
More details can be found here: [https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specifying-credentials](https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specifying-credentials)

## Flags

| Flag                     | Type    | Description                                                                                                                                                                                                                                           |
| :----------------------- | :------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--aws-key-id`           | string  | The AWS access key ID.                                                                                                                                                                                                                                |
| `--aws-region`           | string  | The AWS region.                                                                                                                                                                                                                                       |
| `--aws-secret-key`       | string  | The AWS secret access key.                                                                                                                                                                                                                            |
| `-D`, `--dry-run`        | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                                                                  |
| `--exclude`              | strings | \[optional] The comma-separated list of AWS Lambda function names to be excluded. Cannot be used together with `--function-names`                                                                                                                     |
| `--exclude-regex`        | strings | \[optional] The comma-separated list of name regex patterns for AWS Lambda functions to be excluded. Cannot be used together with `--function-names`. Allowed regex patterns are described in [RE2 syntax](https://github.com/google/re2/wiki/Syntax) |
| `--function-name`        | strings | \[optional] The name of the AWS Lambda function. (DEPRECATED: use `--function-names` instead)                                                                                                                                                         |
| `--function-names`       | strings | \[optional] The comma-separated list of AWS Lambda function names to be reported. Cannot be used together with `--exclude` or `--exclude-regex`.                                                                                                      |
| `--function-names-regex` | strings | \[optional] The comma-separated list of AWS Lambda function names regex patterns to be reported. Cannot be used together with `--exclude` or `--exclude-regex`.                                                                                       |
| `--function-version`     | string  | \[optional] The version of the AWS Lambda function. (DEPRECATED: `--function-version` is no longer supported. It will be removed in a future release.)                                                                                                |
| `-h`, `--help`           | bool    | help for lambda                                                                                                                                                                                                                                       |

## Flags inherited from parent commands

| Flag                        | Type   | Description                                                                                                                                                                                                                                              |
| :-------------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-a`, `--api-token`         | string | The Kosli API token.                                                                                                                                                                                                                                     |
| `-A`, `--auto-environment`  | bool   | \[optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot.                                                                                                    |
| `-c`, `--config-file`       | string | \[optional] The Kosli config file path. (default "kosli")                                                                                                                                                                                                |
| `--debug`                   | bool   | \[optional] Print debug logs to stdout.                                                                                                                                                                                                                  |
| `--environment-description` | string | \[optional] The environment description.                                                                                                                                                                                                                 |
| `--exclude-scaling`         | bool   | \[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) |
| `-H`, `--host`              | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                                                                                                                              |
| `--http-proxy`              | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                                                                                                                              |
| `--include-scaling`         | bool   | \[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)     |
| `-r`, `--max-api-retries`   | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                                                                                                                  |
| `--org`                     | string | The Kosli organization.                                                                                                                                                                                                                                  |
| `-q`, `--quiet`             | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins.                                                                                                  |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report all Lambda functions running in an AWS account (AWS auth provided in env variables)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export AWS_REGION=yourAWSRegion
    export AWS_ACCESS_KEY_ID=yourAWSAccessKeyID
    export AWS_SECRET_ACCESS_KEY=yourAWSSecretAccessKey

    kosli snapshot lambda yourEnvironmentName 

    ```
  </Accordion>

  <Accordion title="report all (excluding some) Lambda functions running in an AWS account (AWS auth provided in env variables)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export AWS_REGION=yourAWSRegion
    export AWS_ACCESS_KEY_ID=yourAWSAccessKeyID
    export AWS_SECRET_ACCESS_KEY=yourAWSSecretAccessKey

    kosli snapshot lambda yourEnvironmentName 
        --exclude function1,function2 
    	--exclude-regex "^not-wanted.*" 

    ```
  </Accordion>

  <Accordion title="report what is running in the latest version of an AWS Lambda function (AWS auth provided in env variables)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export AWS_REGION=yourAWSRegion
    export AWS_ACCESS_KEY_ID=yourAWSAccessKeyID
    export AWS_SECRET_ACCESS_KEY=yourAWSSecretAccessKey

    kosli snapshot lambda yourEnvironmentName 
    	--function-names yourFunctionName 

    ```
  </Accordion>

  <Accordion title="report what is running in the latest version of AWS Lambda functions that match a name regex">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export AWS_REGION=yourAWSRegion
    export AWS_ACCESS_KEY_ID=yourAWSAccessKeyID
    export AWS_SECRET_ACCESS_KEY=yourAWSSecretAccessKey

    kosli snapshot lambda yourEnvironmentName 
    	--function-names-regex yourFunctionNameRegexPattern 

    ```
  </Accordion>

  <Accordion title="report what is running in the latest version of multiple AWS Lambda functions (AWS auth provided in env variables)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export AWS_REGION=yourAWSRegion
    export AWS_ACCESS_KEY_ID=yourAWSAccessKeyID
    export AWS_SECRET_ACCESS_KEY=yourAWSSecretAccessKey

    kosli snapshot lambda yourEnvironmentName 
    	--function-names yourFirstFunctionName,yourSecondFunctionName 

    ```
  </Accordion>

  <Accordion title="report what is running in the latest version of an AWS Lambda function (AWS auth provided in flags)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot lambda yourEnvironmentName 
    	--function-names yourFunctionName 
    	--aws-key-id yourAWSAccessKeyID 
    	--aws-secret-key yourAWSSecretAccessKey 
    	--aws-region yourAWSRegion 
    ```
  </Accordion>
</AccordionGroup>


# kosli snapshot path
Source: https://docs.kosli.com/client_reference/kosli_snapshot_path

Report a snapshot of a single artifact running in a specific filesystem path to Kosli.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli snapshot path ENVIRONMENT-NAME [flags]
```

Report a snapshot of a single artifact running in a specific filesystem path to Kosli.\
You can report a directory or file artifact. For reporting multiple artifacts in one go, use "kosli snapshot paths".
You can exclude certain paths or patterns from the artifact fingerprint using `--exclude`.
The supported glob pattern syntax is documented here: [https://pkg.go.dev/path/filepath#Match](https://pkg.go.dev/path/filepath#Match) ,
plus the ability to use recursive globs "\*\*"

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

## Flags

| Flag              | Type    | Description                                                                                                                          |
| :---------------- | :------ | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-x`, `--exclude` | strings | \[optional] The comma-separated list of literal paths or glob patterns to exclude when fingerprinting the artifact.                  |
| `-h`, `--help`    | bool    | help for path                                                                                                                        |
| `--name`          | string  | The reported name of the artifact.                                                                                                   |
| `--path`          | string  | The base path for the artifact to snapshot.                                                                                          |
| `--watch`         | bool    | \[optional] Watch the filesystem for changes and report snapshots of artifacts running in specific filesystem paths to Kosli.        |

## Flags inherited from parent commands

| Flag                        | Type   | Description                                                                                                                                                                                                                                              |
| :-------------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-a`, `--api-token`         | string | The Kosli API token.                                                                                                                                                                                                                                     |
| `-A`, `--auto-environment`  | bool   | \[optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot.                                                                                                    |
| `-c`, `--config-file`       | string | \[optional] The Kosli config file path. (default "kosli")                                                                                                                                                                                                |
| `--debug`                   | bool   | \[optional] Print debug logs to stdout.                                                                                                                                                                                                                  |
| `--environment-description` | string | \[optional] The environment description.                                                                                                                                                                                                                 |
| `--exclude-scaling`         | bool   | \[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) |
| `-H`, `--host`              | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                                                                                                                              |
| `--http-proxy`              | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                                                                                                                              |
| `--include-scaling`         | bool   | \[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)     |
| `-r`, `--max-api-retries`   | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                                                                                                                  |
| `--org`                     | string | The Kosli organization.                                                                                                                                                                                                                                  |
| `-q`, `--quiet`             | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins.                                                                                                  |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report one artifact running in a specific path in a filesystem">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot path yourEnvironmentName 
    	--path path/to/your/artifact/dir/or/file 
    	--name yourArtifactDisplayName 

    ```
  </Accordion>

  <Accordion title="report one artifact running in a specific path in a filesystem AND exclude certain path patterns">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot path yourEnvironmentName 
    	--path path/to/your/artifact/dir 
    	--name yourArtifactDisplayName 
    	--exclude **/log,unwanted.txt,path/**/output.txt
    ```
  </Accordion>
</AccordionGroup>


# kosli snapshot paths
Source: https://docs.kosli.com/client_reference/kosli_snapshot_paths

Report a snapshot of artifacts running in specific filesystem paths to Kosli.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli snapshot paths ENVIRONMENT-NAME [flags]
```

Report a snapshot of artifacts running in specific filesystem paths to Kosli.\
You can report directory or file artifacts in one or more filesystem paths.
Artifacts names and the paths to include and exclude when fingerprinting them can be
defined in a paths file which can be provided using `--paths-file`.

Paths files can be in YAML, JSON or TOML formats.
They specify a list of artifacts to fingerprint. For each artifact, the file specifies a base path to look for the artifact in
and (optionally) a list of paths to exclude. Excluded paths are relative to the artifact path(s) and can be literal paths or
glob patterns.\
The supported glob pattern syntax is documented here: [https://pkg.go.dev/path/filepath#Match](https://pkg.go.dev/path/filepath#Match) ,
plus the ability to use recursive globs "\*\*"

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

This is an example YAML paths spec file:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
version: 1
artifacts:
  artifact_name_a:
    path: dir1
    exclude: [subdir1, **/log]
```

## Flags

| Flag              | Type   | Description                                                                                                                          |
| :---------------- | :----- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool   | help for paths                                                                                                                       |
| `--paths-file`    | string | The path to a paths file in YAML/JSON/TOML format. Cannot be used together with `--path` .                                           |
| `--watch`         | bool   | \[optional] Watch the filesystem for changes and report snapshots of artifacts running in specific filesystem paths to Kosli.        |

## Flags inherited from parent commands

| Flag                        | Type   | Description                                                                                                                                                                                                                                              |
| :-------------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-a`, `--api-token`         | string | The Kosli API token.                                                                                                                                                                                                                                     |
| `-A`, `--auto-environment`  | bool   | \[optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot.                                                                                                    |
| `-c`, `--config-file`       | string | \[optional] The Kosli config file path. (default "kosli")                                                                                                                                                                                                |
| `--debug`                   | bool   | \[optional] Print debug logs to stdout.                                                                                                                                                                                                                  |
| `--environment-description` | string | \[optional] The environment description.                                                                                                                                                                                                                 |
| `--exclude-scaling`         | bool   | \[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) |
| `-H`, `--host`              | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                                                                                                                              |
| `--http-proxy`              | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                                                                                                                              |
| `--include-scaling`         | bool   | \[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)     |
| `-r`, `--max-api-retries`   | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                                                                                                                  |
| `--org`                     | string | The Kosli organization.                                                                                                                                                                                                                                  |
| `-q`, `--quiet`             | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins.                                                                                                  |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report one or more artifacts running in a filesystem using a path spec file">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot paths yourEnvironmentName 
    	--paths-file path/to/your/paths/file 
    ```
  </Accordion>
</AccordionGroup>


# kosli snapshot s3
Source: https://docs.kosli.com/client_reference/kosli_snapshot_s3

Report a snapshot of the content of an AWS S3 bucket to Kosli.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli snapshot s3 ENVIRONMENT-NAME [flags]
```

Report a snapshot of the content of an AWS S3 bucket to Kosli.

To authenticate to AWS, you can either:

1. provide the AWS static credentials via flags or by exporting the equivalent KOSLI env vars (e.g. KOSLI\_AWS\_KEY\_ID)
2. export the AWS env vars (e.g. AWS\_ACCESS\_KEY\_ID).
3. Use a shared config/credentials file under the \$HOME/.aws

Option 1 takes highest precedence, while option 3 is the lowest.
More details can be found here: [https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specifying-credentials](https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specifying-credentials)

You can report the entire bucket content, or filter some of the content using `--include` / `--exclude` (literal prefix match) or `--include-regex` / `--exclude-regex` (Go regular expressions matched against the full object key).
In all cases, the content is reported as one artifact. If you wish to report separate files/dirs within the same bucket as separate artifacts, you need to run the command twice.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

## Flags

| Flag               | Type    | Description                                                                                                                                                                                                        |
| :----------------- | :------ | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--aws-key-id`     | string  | The AWS access key ID.                                                                                                                                                                                             |
| `--aws-region`     | string  | The AWS region.                                                                                                                                                                                                    |
| `--aws-secret-key` | string  | The AWS secret access key.                                                                                                                                                                                         |
| `--bucket`         | string  | The name of the S3 bucket.                                                                                                                                                                                         |
| `-D`, `--dry-run`  | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                                               |
| `-x`, `--exclude`  | strings | \[optional] The comma separated list of file and/or directory paths in the S3 bucket to exclude when fingerprinting. Paths match by literal prefix. Cannot be used together with `--include` or `--include-regex`. |
| `--exclude-regex`  | strings | \[optional] The comma separated list of Go regular expressions matched against object keys in the S3 bucket to exclude when fingerprinting. Cannot be used together with `--include` or `--include-regex`.         |
| `-h`, `--help`     | bool    | help for s3                                                                                                                                                                                                        |
| `-i`, `--include`  | strings | \[optional] The comma separated list of file and/or directory paths in the S3 bucket to include when fingerprinting. Paths match by literal prefix. Cannot be used together with `--exclude` or `--exclude-regex`. |
| `--include-regex`  | strings | \[optional] The comma separated list of Go regular expressions matched against object keys in the S3 bucket to include when fingerprinting. Cannot be used together with `--exclude` or `--exclude-regex`.         |

## Flags inherited from parent commands

| Flag                        | Type   | Description                                                                                                                                                                                                                                              |
| :-------------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-a`, `--api-token`         | string | The Kosli API token.                                                                                                                                                                                                                                     |
| `-A`, `--auto-environment`  | bool   | \[optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot.                                                                                                    |
| `-c`, `--config-file`       | string | \[optional] The Kosli config file path. (default "kosli")                                                                                                                                                                                                |
| `--debug`                   | bool   | \[optional] Print debug logs to stdout.                                                                                                                                                                                                                  |
| `--environment-description` | string | \[optional] The environment description.                                                                                                                                                                                                                 |
| `--exclude-scaling`         | bool   | \[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) |
| `-H`, `--host`              | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                                                                                                                              |
| `--http-proxy`              | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                                                                                                                              |
| `--include-scaling`         | bool   | \[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)     |
| `-r`, `--max-api-retries`   | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                                                                                                                  |
| `--org`                     | string | The Kosli organization.                                                                                                                                                                                                                                  |
| `-q`, `--quiet`             | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins.                                                                                                  |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="report the contents of an entire AWS S3 bucket (AWS auth provided in env variables)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export AWS_REGION=yourAWSRegion
    export AWS_ACCESS_KEY_ID=yourAWSAccessKeyID
    export AWS_SECRET_ACCESS_KEY=yourAWSSecretAccessKey

    kosli snapshot s3 yourEnvironmentName 
    	--bucket yourBucketName 

    ```
  </Accordion>

  <Accordion title="report what is running in an AWS S3 bucket (AWS auth provided in flags)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot s3 yourEnvironmentName 
    	--bucket yourBucketName 
    	--aws-key-id yourAWSAccessKeyID 
    	--aws-secret-key yourAWSSecretAccessKey 
    	--aws-region yourAWSRegion 

    ```
  </Accordion>

  <Accordion title="report a subset of contents of an AWS S3 bucket (AWS auth provided in env variables)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export AWS_REGION=yourAWSRegion
    export AWS_ACCESS_KEY_ID=yourAWSAccessKeyID
    export AWS_SECRET_ACCESS_KEY=yourAWSSecretAccessKey

    kosli snapshot s3 yourEnvironmentName 
    	--bucket yourBucketName 
    	--include file.txt,path/within/bucket 

    ```
  </Accordion>

  <Accordion title="report contents of an entire AWS S3 bucket, except for some paths (AWS auth provided in env variables)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export AWS_REGION=yourAWSRegion
    export AWS_ACCESS_KEY_ID=yourAWSAccessKeyID
    export AWS_SECRET_ACCESS_KEY=yourAWSSecretAccessKey

    kosli snapshot s3 yourEnvironmentName 
    	--bucket yourBucketName 
    	--exclude file.txt,path/within/bucket 

    ```
  </Accordion>

  <Accordion title="report contents of an AWS S3 bucket, excluding all PNG files via a regex">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot s3 yourEnvironmentName 
    	--bucket yourBucketName 
    	--exclude-regex '.*\.png$' 
    ```
  </Accordion>
</AccordionGroup>


# kosli snapshot server
Source: https://docs.kosli.com/client_reference/kosli_snapshot_server

Report a snapshot of artifacts running in a server environment to Kosli.  

<Warning>
  This command is deprecated. Deprecated commands will be removed in a future
  release.
</Warning>

use 'kosli snapshot paths' instead

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli snapshot server ENVIRONMENT-NAME [flags]
```

Report a snapshot of artifacts running in a server environment to Kosli.\
You can report directory or file artifacts in one or more server paths.

When fingerprinting a 'dir' artifact, you can exclude certain paths from fingerprint calculation
using the `--exclude` flag.
Excluded paths are relative to the DIR-PATH and can be literal paths or glob patterns.
With a directory structure like this `foo/bar/zam/file.txt` if you are calculating the fingerprint of `foo/bar` you need to
exclude `zam/file.txt` which is relative to the DIR-PATH.
The supported glob pattern syntax is what is documented here: [https://pkg.go.dev/path/filepath#Match](https://pkg.go.dev/path/filepath#Match) ,
plus the ability to use recursive globs "\*\*"

If the directory structure contains a symbolic link to a *file* (for example, a link 'from/this/file' and a target of 'to/another/file') then:

* the name of the link ('from/this/file') *is* included in the fingerprint.
* the name of the link ('from/this/file') *is* subject to `.kosli_ignore` entries.
* the name of the target ('to/another/file') is *not* included in the fingerprint.
* the content of target *is* included in the fingerprint, even if the target is outside the root directory being fingerprinted.

If the directory structure contains a symbolic link to a *directory* (for example, a link 'from/this/dir' and a target of 'to/another/dir') then:

* the name of the link ('from/this/dir') *is* included in the fingerprint.
* the name of the link ('from/this/dir') *is* subject to `.kosli_ignore` entries.
* the name of the target ('to/another/dir') *is* included in the fingerprint, even if the target is outside the root directory being fingerprinted.
* the name of the target ('to/another/dir') is *not* subject to `.kosli_ignore` entries.
* the content of the target is *not* included in the fingerprint.

To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact.
Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`.
The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself.

## Flags

| Flag              | Type    | Description                                                                                                                                                                            |
| :---------------- | :------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool    | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                                                   |
| `-e`, `--e`       | strings | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns. (DEPRECATED: use `-x` instead)                                   |
| `-x`, `--exclude` | strings | \[optional] The comma separated list of directories and files to exclude from fingerprinting. Can take glob patterns.                                                                  |
| `-h`, `--help`    | bool    | help for server                                                                                                                                                                        |
| `-p`, `--paths`   | strings | The comma separated list of absolute or relative paths of artifact directories or files. Can take glob patterns, but be aware that each matching path will be reported as an artifact. |

## Flags inherited from parent commands

| Flag                        | Type   | Description                                                                                                                                                                                                                                              |
| :-------------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-a`, `--api-token`         | string | The Kosli API token.                                                                                                                                                                                                                                     |
| `-A`, `--auto-environment`  | bool   | \[optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot.                                                                                                    |
| `-c`, `--config-file`       | string | \[optional] The Kosli config file path. (default "kosli")                                                                                                                                                                                                |
| `--debug`                   | bool   | \[optional] Print debug logs to stdout.                                                                                                                                                                                                                  |
| `--environment-description` | string | \[optional] The environment description.                                                                                                                                                                                                                 |
| `--exclude-scaling`         | bool   | \[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) |
| `-H`, `--host`              | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                                                                                                                              |
| `--http-proxy`              | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                                                                                                                              |
| `--include-scaling`         | bool   | \[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.)     |
| `-r`, `--max-api-retries`   | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                                                                                                                  |
| `--org`                     | string | The Kosli organization.                                                                                                                                                                                                                                  |
| `-q`, `--quiet`             | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins.                                                                                                  |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# report directory artifacts running in a server at a list of paths:
kosli snapshot server yourEnvironmentName \
	--paths a/b/c,e/f/g \
	--api-token yourAPIToken \
	--org yourOrgName  
	
# exclude certain paths when reporting directory artifacts: 
# in the example below, any path matching [a/b/c/logs, a/b/c/*/logs, a/b/c/*/*/logs]
# will be skipped when calculating the fingerprint
kosli snapshot server yourEnvironmentName \
	--paths a/b/c \
	--exclude logs,"*/logs","*/*/logs"
	--api-token yourAPIToken \
	--org yourOrgName 
	
# use glob pattern to match paths to report them as directory artifacts: 
# in the example below, any path matching "*/*/src" under top-dir/ will be reported as a separate artifact.
kosli snapshot server yourEnvironmentName \
	--paths "top-dir/*/*/src" \
	--api-token yourAPIToken \
	--org yourOrgName
```


# kosli status
Source: https://docs.kosli.com/client_reference/kosli_status

Check the status of a Kosli server.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli status [flags]
```

Check the status of a Kosli server.\
The status is logged and the command always exits with 0 exit code.\
If you like to assert the Kosli server status, you can use the `--assert` flag or the "kosli assert status" command.

## Flags

| Flag           | Type | Description                                                            |
| :------------- | :--- | :--------------------------------------------------------------------- |
| `--assert`     | bool | \[optional] Exit with non-zero code if Kosli server is not responding. |
| `-h`, `--help` | bool | help for status                                                        |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |


# kosli tag
Source: https://docs.kosli.com/client_reference/kosli_tag

Tag a resource in Kosli with key-value pairs.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli tag RESOURCE-TYPE [RESOURCE-ID] [flags]
```

Tag a resource in Kosli with key-value pairs.\
use --set to add or update tags, and --unset to remove tags.

Valid resource types are: flow, flows, env, environment, environments, control, controls, repo, repos.

Repos are identified by their name. If multiple repos share the same name
across VCS providers, use --provider to disambiguate, or tag the repo
unambiguously by its internal ID with --repo-id (see: kosli get repo).
Note: in dry-run mode the repo name is not resolved to its internal ID
(no request is made to Kosli), so the previewed request URL contains the
name as-is, whereas a real run sends the resolved ID.

## Flags

| Flag              | Type           | Description                                                                                                                                                       |
| :---------------- | :------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.                              |
| `-h`, `--help`    | bool           | help for tag                                                                                                                                                      |
| `--provider`      | string         | \[optional] The VCS provider of the repo (e.g. github, gitlab). Only valid when tagging repos; required when multiple repos share the same name across providers. |
| `--repo-id`       | string         | \[optional] The repo's internal ID (see: kosli get repo). Only valid when tagging repos; replaces the RESOURCE-ID argument and identifies the repo unambiguously. |
| `-s`, `--set`     | stringToString | \[optional] The key-value pairs to tag the resource with. The format is: key=value                                                                                |
| `-u`, `--unset`   | strings        | \[optional] The list of tag keys to remove from the resource.                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Live Examples in different CI systems

<Tabs>
  <Tab title="GitHub">
    View an example of the `kosli tag` command in GitHub.

    In [this YAML file](https://github.com/cyber-dojo/aws-prod-co-promotion/blob/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584/.github/workflows/promote_one.yml#L74)
  </Tab>

  <Tab title="GitLab">
    View an example of the `kosli tag` command in GitLab.

    In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/42876c4da26ee74e4bbfe14c2949cc7cb2d3345e/.gitlab/workflows/main.yml#L55)
  </Tab>
</Tabs>

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="add/update tags to a flow">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag flow yourFlowName 
    	--set key1=value1 
    	--set key2=value2 

    ```
  </Accordion>

  <Accordion title="tag an environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag env yourEnvironmentName 
    	--set key1=value1 
    	--set key2=value2 

    ```
  </Accordion>

  <Accordion title="add/update tags to an environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag env yourEnvironmentName 
    	--set key1=value1 
    	--set key2=value2 

    ```
  </Accordion>

  <Accordion title="remove tags from an environment">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag env yourEnvironmentName 
    	--unset key1=value1 

    ```
  </Accordion>

  <Accordion title="tag a control">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag control yourControlIdentifier 
    	--set key1=value1 

    ```
  </Accordion>

  <Accordion title="tag a repo">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag repo yourOrg/yourRepoName 
    	--set key1=value1 

    ```
  </Accordion>

  <Accordion title="tag a repo whose name exists across multiple VCS providers">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag repo yourOrg/yourRepoName 
    	--provider github 
    	--set key1=value1 

    ```
  </Accordion>

  <Accordion title="tag a repo by its internal ID (see: kosli get repo)">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli tag repo --repo-id yourRepoID 
    	--set key1=value1 
    ```
  </Accordion>
</AccordionGroup>


# kosli unarchive control
Source: https://docs.kosli.com/client_reference/kosli_unarchive_control

Unarchive a Kosli control.

<Warning>
  This is a beta feature. Beta features provide early access to product
  functionality. These features may change between releases without warning, or
  can be removed in a future release. Please contact us to enable this feature
  for your organization.
</Warning>

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli unarchive control CONTROL-IDENTIFIER [flags]
```

Unarchive a Kosli control.
Restores a previously archived control to the active state.

## Flags

| Flag              | Type | Description                                                                                                                          |
| :---------------- | :--- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool | help for control                                                                                                                     |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="unarchive a Kosli control">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli unarchive control yourControlIdentifier 
    ```
  </Accordion>
</AccordionGroup>


# kosli update control
Source: https://docs.kosli.com/client_reference/kosli_update_control

Update a Kosli control.

<Warning>
  This is a beta feature. Beta features provide early access to product
  functionality. These features may change between releases without warning, or
  can be removed in a future release. Please contact us to enable this feature
  for your organization.
</Warning>

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli update control CONTROL-IDENTIFIER [flags]
```

Update a Kosli control.

Only the flags you provide are changed; omitted fields are left untouched.
Providing `--link` replaces all of the control's existing links.

## Flags

| Flag                  | Type           | Description                                                                                                                          |
| :-------------------- | :------------- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-d`, `--description` | string         | \[optional] The control description.                                                                                                 |
| `-D`, `--dry-run`     | bool           | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`        | bool           | help for control                                                                                                                     |
| `--link`              | stringToString | \[optional] A link for the control, given as 'name=url'. Can be repeated. Replaces all existing links.                               |
| `-n`, `--name`        | string         | \[optional] The new control name.                                                                                                    |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="update a control's name">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli update control yourControlIdentifier 
    	--name "New control name" 

    ```
  </Accordion>

  <Accordion title="update a control's description and links">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli update control yourControlIdentifier 
    	--description "what this control checks" 
    	--link runbook=https://example.com/runbook 
    ```
  </Accordion>
</AccordionGroup>


# kosli update default-org
Source: https://docs.kosli.com/client_reference/kosli_update_default-org

Set the default organization for the current user.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli update default-org ORG-NAME [flags]
```

Set the default organization for the current user.
The default organization is the one selected by default in the Kosli Web UI when you log in.

## Flags

| Flag              | Type | Description                                                                                                                          |
| :---------------- | :--- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-D`, `--dry-run` | bool | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`    | bool | help for default-org                                                                                                                 |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="set the default organization for the current user">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli update default-org yourOrgName 
    ```
  </Accordion>
</AccordionGroup>


# kosli update service-account
Source: https://docs.kosli.com/client_reference/kosli_update_service-account

Update a service account.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli update service-account SERVICE-ACCOUNT-NAME [flags]
```

Update a service account.

Only the flags you provide are changed; omitted fields are left untouched.

## Flags

| Flag                  | Type   | Description                                                                                                                          |
| :-------------------- | :----- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `-d`, `--description` | string | \[optional] A description for the service account.                                                                                   |
| `-D`, `--dry-run`     | bool   | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-h`, `--help`        | bool   | help for service-account                                                                                                             |
| `--privilege`         | string | The privilege granted to the service account. One of: \[admin, member, snapshotter, reader].                                         |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="update a service account's description">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli update service-account yourServiceAccountName 
    	--description "new description" 

    ```
  </Accordion>

  <Accordion title="update a service account's privilege">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli update service-account yourServiceAccountName 
    	--privilege member 
    ```
  </Accordion>
</AccordionGroup>


# kosli version
Source: https://docs.kosli.com/client_reference/kosli_version

Print the version of a Kosli CLI.  

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli version [flags]
```

Print the version of a Kosli CLI.\
The output will look something like this:
version.BuildInfo\{Version:"v0.0.1", GitCommit:"fe51cd1e31e6a202cba7dead9552a6d418ded79a", GitTreeState:"clean", GoVersion:"go1.16.3"}

* Version is the semantic version of the release.
* GitCommit is the SHA for the commit that this version was built from.
* GitTreeState is "clean" if there are no local code changes when this binary was
  built, and "dirty" if the binary was built from locally modified code.
* GoVersion is the version of Go that was used to compile Kosli CLI.

## Flags

| Flag            | Type | Description                                          |
| :-------------- | :--- | :--------------------------------------------------- |
| `-h`, `--help`  | bool | help for version                                     |
| `-s`, `--short` | bool | \[optional] Print only the Kosli CLI version number. |

## Flags inherited from parent commands

| Flag                      | Type   | Description                                                                                                                                             |
| :------------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-a`, `--api-token`       | string | The Kosli API token.                                                                                                                                    |
| `-c`, `--config-file`     | string | \[optional] The Kosli config file path. (default "kosli")                                                                                               |
| `--debug`                 | bool   | \[optional] Print debug logs to stdout.                                                                                                                 |
| `-H`, `--host`            | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)")                                                             |
| `--http-proxy`            | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`                                             |
| `-r`, `--max-api-retries` | int    | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)                                                 |
| `--org`                   | string | The Kosli organization.                                                                                                                                 |
| `-q`, `--quiet`           | bool   | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |


# Output and verbosity
Source: https://docs.kosli.com/client_reference/output_and_verbosity

How the Kosli CLI writes output, what warnings mean, and how to control verbosity.

This page explains where the Kosli CLI writes its output, what `[warning]` messages mean, and how to control verbosity in scripts and CI/CD pipelines.

## Where output goes

The CLI splits its output across two streams:

* **stdout** — Command results: created object IDs, JSON, tables, and any value intended to be piped or captured.
* **stderr** — Warnings, debug lines, and the "new version available" update notice.

The **exit code** is the authoritative success or failure signal. A non-zero exit code means the command failed; zero means it succeeded, regardless of what appeared on stderr.

## Warning messages

Warnings are written in the form `[warning] <message>` and indicate a non-fatal condition that the CLI worked around. Examples:

```text theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
[warning] failed to get git repo info. <details>
[warning] Repo URL will not be reported, <details>
[warning] failed to remove evidence file <path>: <details>
```

Warnings:

* Are always written to **stderr**.
* **Never** affect the exit code.
* Are not errors — the command completed successfully.

If you see a warning in a pipeline that you have already validated end-to-end, it is safe to suppress it (see below). If a warning is new or unexpected, read the message and address the underlying cause.

## Verbosity controls

| Flag            | Effect                                                                                                                   |
| --------------- | ------------------------------------------------------------------------------------------------------------------------ |
| *(default)*     | Errors and `[warning]` lines to stderr. Results to stdout.                                                               |
| `-q`, `--quiet` | Suppresses `[warning]` lines. Errors still print.                                                                        |
| `--debug`       | Adds `[debug]` lines to stderr. Overrides `--quiet`.                                                                     |
| `--debug=false` | Explicit-off form. Useful when a parent process or env var has enabled debug and you want to disable it for one command. |

When both `--quiet` and `--debug` are set, `--debug` wins and a debug notice is printed explaining the override.

Both flags have equivalent environment variables, following the standard `KOSLI_` prefix:

* `KOSLI_QUIET=true`
* `KOSLI_DEBUG=true`

## Warnings in CI/CD pipelines

CI systems including Jenkins, Azure DevOps, Bitbucket Pipelines, and GitHub Actions multiplex stdout and stderr into a single build log. Some render stderr lines in red or with error-level styling. This makes non-fatal `[warning]` lines look alarming to pipeline reviewers even though they have no effect on the build.

Once you have validated a workflow end-to-end, add `--quiet` (or set `KOSLI_QUIET=true`) to the Kosli CLI invocations to keep build logs clean:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest generic --quiet ...
```

<Warning>
  Avoid redirecting all of stderr to `/dev/null` (for example, `kosli ... 2>/dev/null`). That hides genuine error messages and makes failures much harder to diagnose. Prefer `--quiet`, which suppresses only `[warning]` lines and keeps real errors visible.
</Warning>

If you are capturing CLI output in a shell subshell and seeing debug or warning lines mixed into the captured value, see [CLI in subshell captures stderr](/troubleshooting/subshell_stderr).

## See also

* [kosli root command and global flags](/client_reference/kosli)
* [CLI in subshell captures stderr](/troubleshooting/subshell_stderr)


# CLI Reference
Source: https://docs.kosli.com/client_reference/overview

Reference documentation for the Kosli CLI.

<Info>
  This reference was generated from Kosli CLI **v2.39.2**.
</Info>

The Kosli CLI allows you to interact with Kosli from your terminal and CI/CD pipelines.

For installation instructions, see [Install the Kosli CLI](/getting_started/install).

## Commands

Browse the CLI commands using the sidebar navigation, or start with the [kosli](/client_reference/kosli) root command to see global flags and environment variable configuration.

## Output and verbosity

See [Output and verbosity](/client_reference/output_and_verbosity) for how the CLI uses stdout and stderr, what `[warning]` messages mean, and how to control output in scripts and CI/CD pipelines with `--quiet` and `--debug`.


# FAQ
Source: https://docs.kosli.com/faq/faq

Frequently asked questions

<AccordionGroup>
  <Accordion title="Where can I find API documentation?">
    Kosli API documentation is available for logged-in Kosli users at [app.kosli.com/api/v2/doc](https://app.kosli.com/api/v2/doc/).
    You can also find the link at [app.kosli.com](https://app.kosli.com) after clicking your avatar (top-right corner of the page).
  </Accordion>

  <Accordion title="Do I have to provide all the flags all the time?">
    A number of flags won't change their values often (or at all) between commands, like `--org` or `--api-token`. Some will differ between e.g. workflows, like `--flow`. You can define them as environment variables to avoid unnecessary redundancy. Check [Environment variables](/getting_started/install#assigning-flags-via-environment-variables) to learn more.
  </Accordion>

  <Accordion title="What is dry run and how to use it?">
    You can use dry run to disable writing to `app.kosli.com` — e.g. if you're just trying things out, or troubleshooting (dry run will print the payload the CLI would send in a non dry run mode).

    There are three ways to enable a dry run:

    1. Use the `--dry-run` flag (no value needed) to enable it per command
    2. Set the `KOSLI_DRY_RUN` environment variable to `true` to enable it globally (e.g. in your terminal or CI)
    3. Set the `KOSLI_API_TOKEN` environment variable to `DRY_RUN` to enable it globally (e.g. in your terminal or CI)
  </Accordion>

  <Accordion title="What is the --config-file flag?">
    A config file is an alternative to using Kosli flags or environment variables. Usually you'd use a config file for values that rarely change — like api token or org — but you can represent all Kosli flags in a config file. The key for each value is the same as the flag name, capitalized, so `--api-token` becomes `API-TOKEN`, and `--org` becomes `ORG`, etc.

    You can use JSON, YAML, or TOML format:

    <CodeGroup>
      ```json kosli-conf.json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      {
        "ORG": "my-org",
        "API-TOKEN": "123456abcdef"
      }
      ```

      ```yaml kosli-conf.yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      ORG: "my-org"
      API-TOKEN: "123456abcdef"
      ```

      ```toml kosli-conf.toml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      ORG = "my-org"
      API-TOKEN = "123456abcdef"
      ```
    </CodeGroup>

    When calling a Kosli command you can skip the file extension. For example, to list environments with `org` and `api-token` in the configuration file:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list environments --config-file kosli-conf
    ```

    `--config-file` defaults to `kosli`, so if you name your file `kosli.<yaml|toml|json>` and the file is in the same location as where you run Kosli commands from, you can skip the `--config-file` altogether.
  </Accordion>

  <Accordion title="Reporting the same artifact and evidence multiple times">
    If an artifact or evidence is reported multiple times there are a few corner cases:

    **Template** — When an artifact is reported, the template for the flow is stored together with the artifact. If the template has changed between reports, the last template is considered the template for that artifact.

    **Evidence** — If a given named evidence is reported multiple times, the compliance status of the last reported version is considered the compliance state of that evidence. If an artifact is reported multiple times with different git-commits, the last reported version of the named commit-evidence is considered the compliance state.

    **Evidence outside the template** — If an artifact has evidence (commit or artifact evidence) that is not part of the template, the state of the extra evidence will affect the overall compliance of the artifact.
  </Accordion>

  <Accordion title="How to set compliant status of generic evidence">
    The `--compliant` flag is a [boolean flag](#boolean-flags).
    To report generic evidence as non-compliant use `--compliant=false`:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli report evidence artifact generic server:1.0 \
      --artifact-type docker \
      --name test \
      --description "generic test evidence" \
      --compliant=false \
      --flow server
    ```

    `--compliant` is set to `true` by default, so to report as compliant simply skip the flag altogether.
  </Accordion>

  <Accordion title="Why is my GitHub login failing?">
    If you sign in to Kosli with GitHub, you must have a verified email address on your GitHub account — otherwise login will fail.

    You can check the status of your email addresses at [github.com/settings/emails](https://github.com/settings/emails).
  </Accordion>

  <Accordion title="Why can't I delete or archive a policy?">
    It's not possible to delete a policy in Kosli. This is by design, because there can be snapshots that were previously evaluated using the policy. Deleting it would compromise the integrity of those historical evaluations.

    Archiving policies isn't available yet. If this is something you'd find useful, we'd love to hear about your use case — reach out to us at [support@kosli.com](mailto:support@kosli.com).
  </Accordion>
</AccordionGroup>

## Boolean flags

Flags with values can usually be specified with an `=` or with a **space** as a separator.
For example, `--artifact-type=file` or `--artifact-type file`.
Boolean flags accept both forms from CLI v2.36.0 onwards:

```
kosli attest generic Dockerfile --artifact-type file --compliant false ...
```

On earlier versions an explicitly specified boolean flag value **must** use an `=`.
Either upgrade the CLI, or write the flag as `--compliant=false`.
Without the `=` the command above fails with:

```
Error: accepts at most 1 arg(s), received 2
```

because `--compliant` is parsed as if *implicitly* defaulting to `--compliant=true`, leaving:

```
kosli attest generic Dockerfile false ...
```

The parser then sees `Dockerfile` and `false` as the two
arguments to `kosli attest generic`.

## Empty flag values

A flag given an empty value is an error from CLI v2.37.0 onwards:

```
kosli attest generic Dockerfile --artifact-type file --exclude "" ...
Error: flag '--exclude' was given an empty value
```

The usual cause is a shell variable that is unset, so `--exclude "$BUILD_TMP"`
reaches the CLI as `--exclude ""`. The same applies to a value from a `KOSLI_`
environment variable or from `~/.kosli.yml`, and to an empty element of a
comma-separated list such as `--exclude "node_modules,,vendor"`.

On earlier versions most of these were accepted silently. `--exclude ""`
excluded nothing, so the fingerprint was one no artifact matched;
`--fingerprint ""` recorded an attestation against the trail rather than the
artifact named; `--redact-commit-info ""` sent the commit author and message
the flag exists to withhold. Each exited 0 and printed what success prints.

Either give the flag a real value, or remove it. In almost every case an empty
value did what leaving the flag out does, so removing it keeps the earlier
behavior and says so plainly.

Leaving a flag out is unchanged, including the values filled in from your CI
environment, such as `--build-url`, `--commit-url` and `--repository`.

One case the CLI cannot catch: a boolean flag written without quotes loses the
empty value in the shell rather than in the CLI, so `--compliant ${UNSET}`
arrives as `--compliant` with nothing after it, which is indistinguishable from
typing `--compliant` deliberately. Quote the variable, `--compliant "${VAR}"`,
and it is refused like any other empty value.


# Artifacts
Source: https://docs.kosli.com/getting_started/artifacts

Learn how to attest artifacts to Kosli and establish binary provenance.

In software processes, you typically generate one or more artifacts that are deployed or distributed, such as docker images, archives, binaries, etc. You can ensure traceability for the creation of these artifacts by attesting them to Kosli, thereby establishing a binary provenance for each one.

## Binary provenance

Binary provenance for artifacts refers to the ability to trace and verify the origins, history, and journey of the artifacts throughout their lifecycle. This involves recording immutable attestations about the artifact creation, risk controls performed on it, deployments, and execution/usage.

Artifacts are uniquely identified by their SHA256 fingerprints. When attesting an artifact to Kosli, you have the option to either provide the fingerprint manually or allow Kosli CLI to calculate it automatically for you.

By leveraging the artifact's fingerprint, Kosli can establish connections between the creation of the artifact and its runtime-related events, such as when the artifact starts or ceases execution within a specific environment.

By establishing and maintaining binary provenance for artifacts, Kosli enables you to:

1. **Track Changes**: Trace how your Flow artifacts change over time.
2. **Identify Sources**: Understand where your artifacts originated from, which can help in identifying vulnerabilities or issues.
3. **Monitor Compliance**: Ensure that the artifacts adhere to your compliance requirements.
4. **Enable Audits**: Access audit packages on demand allowing audits and investigations into the software supply chain.
5. **Enhance Trust**: Build trust among users, customers, and stakeholders by providing transparent and verified information about the software's history.

## Attesting artifacts

To attest an artifact, you can run a command similar to the one below:

```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest artifact project-a-app.bin \
	--artifact-type file \
	--build-url https://exampleci.com \
	--commit-url https://github.com/ProjectA/ProjectAApp/commit/e67f2f2b121f9325ebf166b7b3c707f73cb48b14 \
	--commit e67f2f2b121f9325ebf166b7b3c707f73cb48b14 \
	--flow project-a \
	--trail trail-1 \
	--name backend
```

The `--artifact-type` flag is used to determine the type of artifact being attested. The following types are supported:

* **file**: for any single file artifacts (e.g. a binary, Jar file, etc.)
* **dir**: for directory artifacts.
* **docker**: for docker images that are pulled on the machine. This option depends on having a running Docker daemon on the machine.
* **oci**: for container images in docker or OCI format. The fingerprint is fetched directly from the registry.

<Warning>
  **`docker` requires the image to exist in a registry.** Kosli reads the image's repo digest via the local Docker daemon, and a freshly built image (just `docker build`) does not have one until it has been pushed to or pulled from a registry. If you attest an image that has only been built locally, you will see:

  ```
  Error: repo digest unavailable for the image, has it been pushed to or pulled from a registry?
  ```

  You have two options:

  * Push the image to a registry first, then attest it.
  * Use `--artifact-type=oci` and let Kosli fetch the digest directly from the registry.

  See [repo digest unavailable](/troubleshooting/repo_digest_unavailable) for more detail.
</Warning>

See [kosli attest artifact](/client_reference/kosli_attest_artifact/) for more details.

## The `--dry-run` flag

All Kosli CLI commands which write data accept the `--dry-run` [boolean flag](/faq/#boolean-flags).
When this flag is used, a CLI command:

* Does not communicate with Kosli at all
* Prints the payload it would have sent
* Exits with a zero status code

We recommend using the `KOSLI_DRY_RUN` environment variable to automatically set the `--dry-run` flag.
This will allow you to instantly turn off all Kosli CLI commands if Kosli is down, as detailed in
[this tutorial](/troubleshooting/what_do_i_do_if_kosli_is_down).

The `--dry-run` flag is also useful when trying commands locally. For example:

```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest artifact cyberdojo/differ:dde3b2a \
  --artifact-type=docker \
  --org=cyber-dojo \
  --flow=differ-ci \
  --trail=$(git rev-parse HEAD) \
  --dry-run \
  ...

 {
    "fingerprint": "0f53b5b9e7c266defe6984deafe039b116295b2df4a409ba6288c403f2451a9f",
    "filename": "cyberdojo/differ:dde3b2a",
    "git_commit": "fbb9e8000e2344323040e348a54b33ecbf67f273",
    "git_commit_info": {
        "sha1": "fbb9e8000e2344323040e348a54b33ecbf67f273",
        "message": "improve coverage report info (#2796)",
        "author": "Jon Jagger \u003cjon@jaggersoft.com\u003e",
        "timestamp": 1733724563,
        "branch": "master",
        "url": "https://github.com/kosli-dev/server/commit/fbb9e8000e2344323040e348a54b33ecbf67f273"
    },
    "build_url": "https://github.com/cyber-dojo/differ/actions/runs/11777650898",
    "commit_url": "https://github.com/cyber-dojo/differ/commit/dde3b2a7dab8e4567038e4c66ac68f0f01d0f704",
    "repo_url": "https://github.com/kosli-dev/server",
    "template_reference_name": "differ",
    "trail_name": "dde3b2a7dab8e4567038e4c66ac68f0f01d0f704"
}

$ echo $?
0
```


# Attestations
Source: https://docs.kosli.com/getting_started/attestations

Learn how to make attestations to Kosli to prove compliance in your software supply chain.

Attestations are how you record the facts you care about in your software supply chain.
They are the evidence that you have performed certain activities, such as running tests, security scans, or ensuring that a certain requirement is met.

Kosli allows you to report different types of attestations about artifacts and trails.
Kosli will process the evidence you provide and conclude whether the evidence proves compliance or otherwise.

Let's take a look at this example to understand how to make attestations to Kosli.

## Example overview

The following compliance template is expecting 4 attestations, each with its own `name`.

```yml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# yaml-language-server: $schema=https://docs.kosli.com/schemas/flow-template/v1.json
version: 1
trail:
  attestations:
  - name: jira-ticket
    type: jira
  artifacts:
  - name: backend
    attestations:
    - name: unit-tests
      type: junit
    - name: security-scan
      type: snyk
```

<Tip>
  See the [Flow Template reference](/template-reference/flow_template) for the full specification, available attestation types, and editor validation with JSON Schema.
</Tip>

It expects `jira-ticket` on the trail, the `backend` artifact, with `unit-tests` and `security-scan` attached to it.
When you make an attestation, you have the choice of what `name` to attach it to.

### Steps

The following sections show how to make each of the four attestations defined in the template above.

<Steps>
  <Step title="Attest a Jira ticket to the trail">
    The `jira-ticket` attestation belongs to a single trail and is not linked to a specific artifact. In this example, the id of the trail is the git commit.

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest jira \
        --flow backend-ci \
        --trail $(git rev-parse HEAD) \
        --name jira-ticket
        ...
    ```
  </Step>

  <Step title="Attest unit tests to the backend artifact">
    Some attestations are attached to a specific artifact, like the unit tests for the `backend` artifact. Often, evidence like unit tests are created *before* the artifact is built. To attach the evidence to the artifact before its creation, use `backend` (the artifact's `name` from the template), as well as `unit-tests` (the attestation's `name` from the template).

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest junit \
        --name backend.unit-tests \
        --flow backend-ci \
        --trail $(git rev-parse HEAD) \
        ...
    ```

    This attestation belongs to any artifact attested with the matching `name` from the template (in this example `backend`) and a matching git commit.

    <Info>
      Notice this command has **no fingerprint**, no `--artifact-type`, and no positional artifact argument. When you pass `--commit` without a fingerprint, Kosli does not calculate or assume any fingerprint — it stores the attestation as *pending* against the artifact's **template name + commit** and binds it to the real fingerprint later, when an `artifact` attestation arrives for that same template name and commit.

      The match key is `(template artifact name, git commit)` — not the fingerprint. The fingerprint is only resolved retroactively once the artifact itself is reported. Order doesn't matter: you can report `backend.unit-tests` before or after `backend` itself.

      See [Reporting a custom attestation → Attest before the artifact exists](/tutorials/attest_custom#3-attest-before-the-artifact-exists) for the full subtleties.
    </Info>
  </Step>

  <Step title="Attest the backend artifact">
    Once the artifact has been built, it can be attested with the following command.

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest artifact my_company/backend:latest \
      --artifact-type docker \
        --flow backend-ci \
        --trail $(git rev-parse HEAD) \
        --name backend
        ...
    ```

    In this case the Kosli CLI will calculate the fingerprint of the docker image called `my_company/backend:latest` and attest it as the `backend` artifact `name` in the trail.

    <Info>
      In all attestation commands the Kosli CLI automatically gathers the git commit and other information from the current git repository and the [CI environment](/integrations/ci_cd). This is how the git commit is used to match attestations to artifacts.
    </Info>
  </Step>

  <Step title="Attest a security scan to the backend artifact">
    Often, evidence like snyk reports are created *after* the artifact is built. In this case, you can attach the evidence to the artifact after its creation. Use `backend` (the artifact's `name` from the template), as well as `security-scan` (the attestation's `name` from the template) to name the attestation.

    The following attestation will only belong to the artifact `my_company/backend:latest` attested above and its fingerprint, in this case calculated by the Kosli CLI.

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest snyk \
        --artifact-type docker my_company/backend:latest \
        --name backend.security-scan \
        --flow backend-ci \
        --trail $(git rev-parse HEAD)
        ...
    ```
  </Step>
</Steps>

## Compliance

### Attesting with a template

The four attestations above are all made against a Flow named `backend-ci` and a Trail named after the git commit.
Typically, the Flow and Trail are explicitly setup before making the attestations (e.g. at the start of a CI workflow).

This is done with the `create flow` and `begin trail` commands, either of which can specify the name of the template yaml file above
(e.g. `.kosli.yml`) whose contents define overall compliance. For example:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create flow backend-ci \
    --template-file .kosli.yml
    ...

kosli begin trail $(git rev-parse HEAD) \
    --flow backend-ci \
    ...
```

An attested `backend` artifact is then compliant if and only if all the template attestations have been made
against it and are themselves compliant:

* `jira-ticket` on its Trail
* `backend.unit-tests` for its junit evidence
* `backend.security-scan` for its snyk evidence

If any of these attestations are missing, or are individually non-compliant then the `backend` artifact is non-compliant.

### Attesting without a template

An attestation can also be made against a Flow and Trail **not** previously explicitly setup.
In this case a Flow and Trail will be automatically setup but there will be no template yaml file defining
overall compliance. The compliance of any attested artifact will depend only on the compliance of the attestations actually made
and never because a specific attestation is missing.

### Attestation immutability

You can set/edit the template yml file for the Flow/Trail at any time.
This will affect compliance evaluations made after the edit.
It will not affect earlier records of compliance evaluations (e.g. in Environment Snapshots).

Attestations are append-only immutable records. You can report the same attestation multiple times, and each report will be recorded.
However, only the latest version of the attestation is considered when evaluating compliance.

## Evidence Vault

Along with attestations data, you can attach additional supporting evidence files. These will be securely stored in Kosli's **Evidence Vault** and can easily be retrieved when needed. Alternatively, you can store the evidence files in your own preferred storage and only attach links to it in the Kosli attestation.

<Note>
  For `JUnit` attestations (see below), Kosli automatically stores the JUnit XML results files in the Evidence Vault. You can disable this by setting `--upload-results=false`
</Note>

## Attaching data to attestations

All `kosli attest` commands support flags for attaching additional data. These flags accept file paths but serve different purposes:

| Flag                 | Available on                 | Purpose                                                                                                    |
| -------------------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------- |
| `--user-data`        | All evidence attest commands | Attach structured JSON metadata that is stored and visible alongside the attestation in the Kosli UI       |
| `--attachments`      | All evidence attest commands | Upload files or directories to the Evidence Vault as compressed archives for later download                |
| `--attestation-data` | `attest custom` only         | Provide the JSON payload that the custom type's jq rules evaluate to determine compliance                  |
| `--annotate`         | All evidence attest commands | Attach `key=value` annotations that are displayed as a label/value pair on the attestation in the Kosli UI |

### When to use which

Use **`--user-data`** when you want to store additional context — such as build metadata, environment
variables, or tool versions — that is visible alongside the attestation in the Kosli UI.

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest generic \
    --name security-scan \
    --flow backend-ci \
    --trail $(git rev-parse HEAD) \
    --user-data scan-metadata.json
```

Use **`--attachments`** when you want to archive files for audit purposes — such as test reports,
scan output, or policy files — in the Evidence Vault for later retrieval. Provide multiple paths
as a comma-separated list.

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest generic \
    --name security-scan \
    --flow backend-ci \
    --trail $(git rev-parse HEAD) \
    --attachments scan-report.html,scan-config.yml
```

Use **`--attestation-data`** on `kosli attest custom` to provide the JSON data that the custom
attestation type's jq expression evaluates. This is what determines the compliance status of the
attestation. See the [Custom](#custom) attestation type below for details.

The `--attestation-data` JSON payload sent to Kosli is limited to 1 MB; larger payloads fail with a
400 error. For larger reports, distill the data you need into a summary and attach the full document
separately — see [Attesting large documents](/tutorials/attest_large_documents).

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest custom \
    --type coverage-metrics \
    --name unit-tests \
    --flow backend-ci \
    --trail $(git rev-parse HEAD) \
    --attestation-data coverage-results.json
```

<Tip>
  These flags can be combined. For example, you can use `--attestation-data` for compliance evaluation,
  `--user-data` to store extra metadata, and `--attachments` to archive the full report — all on the
  same attestation.
</Tip>

### Annotating attestations

Use **`--annotate`** to attach lightweight `key=value` pairs to an attestation. Annotations are
intended for short, human-readable context (links, ticket IDs, build numbers, environment names,
etc.) that should appear directly on the attestation in the Kosli UI. For larger structured
metadata, prefer `--user-data`.

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest generic \
    --name security-scan \
    --flow backend-ci \
    --trail $(git rev-parse HEAD) \
    --annotate scan_tool=trivy \
    --annotate report_url=https://ci.example.com/runs/42
```

Keys may only contain `[A-Za-z0-9_]` (letters, digits, and underscores). You can pass `--annotate`
multiple times to add several annotations to the same attestation.

<Note>
  **How annotations appear in the Kosli UI**

  Annotation **keys** are automatically humanized for display: underscores become spaces and the
  first letter is capitalized. For example, the key `something_key` is rendered as `Something key`.

  Annotation **values** are displayed as-is, except that values that are valid URLs are
  automatically rendered as clickable links.

  Choose your annotation keys with this transformation in mind — e.g. use `report_url`
  (displayed as `Report url`) rather than mixed-case or camelCase keys.
</Note>

## Attestation types

Currently, we support the following types of evidence:

<AccordionGroup>
  <Accordion title="Pull requests" icon="code-pull-request">
    If you use GitHub, Bitbucket, Gitlab or Azure DevOps you can use Kosli to verify if a given git commit comes from a pull/merge request.

    <Warning>
      Currently, the status of the PR does NOT impact the compliance status of the attestation.
    </Warning>

    If there is no pull request for the commit, the attestation will be reported as `non-compliant`. You can choose to short-circuit execution in case pull request is missing by using the `--assert` flag.

    See the CLI reference for the following commands for more details and examples:

    * [attest Github PR ](/client_reference/kosli_attest_pullrequest_github/)
    * [attest Bitbucket PR ](/client_reference/kosli_attest_pullrequest_bitbucket/)
    * [attest Gitlab PR ](/client_reference/kosli_attest_pullrequest_gitlab/)
    * [attest Azure Devops PR ](/client_reference/kosli_attest_pullrequest_azure/)
  </Accordion>

  <Accordion title="JUnit test results" icon="file-check">
    If you produce your test results in JUnit format, you can attest the test results to Kosli. Kosli will analyze the JUnit results and determine the compliance status based on whether any tests have failed and/or errored or not.

    See [attest JUnit results to an artifact or a trail](/client_reference/kosli_attest_junit/) for usage details and examples.
  </Accordion>

  <Accordion title="Snyk security scans" icon="barcode-read">
    You can report results of a Snyk security scan to Kosli and it will analyze the Snyk scan results and determine the compliance status based on whether vulnerabilities were found or not.

    See [attest Snyk results to an artifact or a trail](/client_reference/kosli_attest_snyk/) for usage details and examples.
  </Accordion>

  <Accordion title="Jira issues" icon="clipboard-list-check">
    You can use the Jira attestation to verify that a git commit or branch contains a reference to a Jira issue and that an issue with the same reference does exist in Jira.

    If Jira reference is found in a commit message, that reference will be reported as evidence. If the reference is not found in the commit message, Kosli CLI will check if it's a part of a branch name.

    Kosli CLI will also verify and report if the detected issue reference is found and accessible on Jira (reported as compliant) or not (reported as non compliant).

    See [attest Jira issue to an artifact or a trail](/client_reference/kosli_attest_jira/) for usage details and examples.
  </Accordion>

  <Accordion title="SonarQube scan results" icon="bug">
    You can report the results of a SonarQube Server or SonarQube Cloud scan to Kosli. Kosli will use the status of the scan's Quality Gate (passing or failing) to determine the compliance status.

    These scan result can be attested in two ways:

    * Using Kosli's [webhook integration](/integrations/sonar) with Sonar
    * Using [Kosli's CLI](/client_reference/kosli_attest_sonar)
  </Accordion>

  <Accordion title="Custom" icon="puzzle-piece">
    The above attestations are all "fully typed" - each one knows how to interpret its own particular kind of input.
    For example, `kosli attest snyk` interprets the sarif file produced by a snyk container scan to determine the `true/false` value.
    If you're using a tool that does not yet have a corresponding kosli attest command we recommend creating your own custom attestation type.

    A custom attestation type specifies one or more arbitrary evaluation rules.
    These rules can have an optional schema specifying the types of the names used in the rules, whether they are required, whether they have defaults, etc.
    When a custom attestation is made using this type its rules are applied to the provided custom attestation data to determine its `true/false` compliance status.

    For example, suppose you wish to attest coverage metrics captured as part of a unit-test run.
    The coverage metrics are being saved in a file called `unit-test-coverage.json` as follows:

    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    {
      "code": {
        "lines": {
          "missed": 32,
          "total": 1209
        }
      },
      ...
    }
    ```

    You could create a custom attestation type called `coverage-metrics` using a [jq expression](https://jqlang.org/manual/) rule defining a minimum line coverage of 95%:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create attestation-type coverage-metrics
      --jq=".code.lines.missed / .code.lines.total * 100 <= 5"
    ```

    You could then make your custom attestation with the json file:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest custom
      --type=coverage-metrics
      --attestation-data=unit-test-coverage.json
      ...
    ```

    For this attestation, Kosli would:

    * Evaluate the rule `.code.lines.missed / .code.lines.total * 100 <= 5`
    * Using the values from the file `unit-test-coverage.json`
      * `.code.lines.missed` is `32`
      * `.code.lines.total` is `1209`
    * So `32 / 1209 * 100 <= 5` evaluates to `2.64 <= 5` which is `true`

    See:

    * [create custom attestation type](/client_reference/kosli_create_attestation-type) and
    * [report custom attestation to an artifact or a trail](/client_reference/kosli_attest_custom/) for usage details and examples.
  </Accordion>

  <Accordion title="Generic" icon="certificate">
    <Warning>
      Generic attestations are an earlier, much less sophisticated version of custom attestations.
      We recommend using custom attestations instead of generic attestations.
    </Warning>

    See [report generic attestation to an artifact or a trail](/client_reference/kosli_attest_generic/) for usage details and examples.
  </Accordion>
</AccordionGroup>


# Authenticating to Kosli
Source: https://docs.kosli.com/getting_started/authenticating_to_kosli

How to get an API token for the Kosli CLI and API, and where to manage credentials.

Most interactions with Kosli — from the CLI, the API, or CI/CD pipelines — require an API token. This page covers the quickest path to getting one and points to the deeper documentation for each topic.

## Pick a credential type

| Use case                              | Credential                                | Where to manage it                                                  |
| ------------------------------------- | ----------------------------------------- | ------------------------------------------------------------------- |
| CI/CD, runtime reporters, automation  | **Service account API key** (recommended) | [Service accounts](/administration/authentication/service_accounts) |
| Interactive scripts tied to your user | **Personal API key**                      | [Personal API keys](/user/personal_api_keys)                        |

<Tip>
  For anything automated, use a service account. Personal API keys inherit your user's permissions across every organization you belong to, which is rarely what you want for a pipeline.
</Tip>

## Quick start: get a token

<Steps>
  <Step title="Sign in to Kosli">
    Open the Kosli web app and sign in:

    * EU: [app.kosli.com](https://app.kosli.com)
    * US: [app.us.kosli.com](https://app.us.kosli.com)
  </Step>

  <Step title="Create a key">
    * **For CI/CD**, follow [Service accounts](/administration/authentication/service_accounts) to create a service account and generate its first API key.
    * **For your own scripts**, follow [Personal API keys](/user/personal_api_keys) to generate a key tied to your user.
  </Step>

  <Step title="Copy the key immediately">
    Kosli stores only a hash of the token, so the original is shown once and cannot be retrieved later. Paste it straight into your secret store.
  </Step>
</Steps>

## Use the token

Pass the token as a bearer token when calling the API directly:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
curl -H "Authorization: Bearer <<your-api-key>>" \
  https://app.kosli.com/api/v2/environments/<<your-org-name>>
```

For CLI usage, basic auth, and full examples, see [API authentication methods](/administration/authentication/api_authentication_methods).

## See also

* [Service accounts](/administration/authentication/service_accounts) — admin lifecycle for machine credentials.
* [API key rotation](/administration/authentication/api_key_rotation) — how rotation works, with a [step-by-step tutorial](/tutorials/rotating_api_keys).
* [Roles in Kosli](/administration/managing_users/roles_in_kosli) — what users and service accounts can do at each role.


# Enforce policies
Source: https://docs.kosli.com/getting_started/enforce_policies

Block non-compliant artifacts from deploying by enforcing policies in CI/CD pipelines, via the API, or with Kubernetes admission controllers.

Environment policies define what an artifact needs to be compliant. Policy enforcement gates check artifacts against those requirements and block deployments when they fall short.

You can enforce policies:

* As a **CI/CD pipeline step** that fails the build on non-compliance
* Through the **Kosli API** for custom tooling
* Via a **Kubernetes admission controller** that rejects non-compliant pods

All methods use the same assertion: checking an artifact's fingerprint against an environment, specific policies, or a flow template.

## Assertion scopes

`kosli assert artifact` (and its API equivalent) supports three assertion modes:

| Mode              | CLI flag          | When to use                                                                                                        |
| ----------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------ |
| Environment       | `--environment`   | Check all policies attached to the target environment. The most common choice for deployment gates.                |
| Specific policies | `--policy`        | Check one or more named policies, regardless of environment attachment. Useful for promotion gates between stages. |
| Flow templates    | *(no scope flag)* | Check against the template files of the flows the artifact appears in.                                             |

`--environment` and `--policy` are mutually exclusive.

`--flow` can be combined with any mode to narrow the lookup to a specific flow. Without `--flow`, all flows containing the artifact (by fingerprint) are considered.

See [`kosli assert artifact`](/client_reference/kosli_assert_artifact) for the full flag reference.

## Enforce in CI/CD pipelines

Add `kosli assert artifact` as a step before your deployment step. If the artifact is non-compliant, the command exits with a non-zero status and the pipeline fails.

### Assert against an environment

Check all policies attached to the target environment:

<Tabs>
  <Tab title="GitHub Actions" icon="github">
    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    - name: Assert artifact compliance
      env:
        KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }}
        KOSLI_ORG: my-org
      run: |
        kosli assert artifact ${{ env.IMAGE }} \
          --artifact-type oci \
          --environment production
    ```
  </Tab>

  <Tab title="GitLab CI" icon="gitlab">
    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    assert-compliance:
      stage: deploy
      script:
        - kosli assert artifact $IMAGE \
            --artifact-type oci \
            --environment production
      variables:
        KOSLI_API_TOKEN: $KOSLI_API_TOKEN
        KOSLI_ORG: my-org
    ```
  </Tab>
</Tabs>

### Assert against specific policies

Check one or more named policies directly. This is useful when gating a promotion between stages or checking policies that are not attached to an environment:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert artifact $IMAGE \
  --artifact-type oci \
  --policy has-tests,has-review
```

<Tip>
  Use `--dry-run` to test assertions without sending data to Kosli. The CLI prints the compliance result but always exits with code 0.
</Tip>

## Enforce via the API

For custom deployment tooling or non-CI contexts, call the assert endpoint directly:

<Tabs>
  <Tab title="EU" icon="globe">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    curl -s \
      -H "Authorization: Bearer $KOSLI_API_TOKEN" \
      "https://app.kosli.com/api/v2/asserts/my-org/fingerprint/$SHA256?environment_name=production"
    ```
  </Tab>

  <Tab title="US" icon="globe">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    curl -s \
      -H "Authorization: Bearer $KOSLI_API_TOKEN" \
      "https://app.us.kosli.com/api/v2/asserts/my-org/fingerprint/$SHA256?environment_name=production"
    ```
  </Tab>
</Tabs>

The response includes:

* `compliant` — `true` or `false`
* `policy_evaluations` — detailed results per policy (when asserting against an environment)
* `compliance_status` — per-attestation compliance breakdown

To assert against specific policies instead of an environment:

<Tabs>
  <Tab title="EU" icon="globe">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    curl -s \
      -H "Authorization: Bearer $KOSLI_API_TOKEN" \
      "https://app.kosli.com/api/v2/asserts/my-org/fingerprint/$SHA256?policy_name=has-tests&policy_name=has-review"
    ```
  </Tab>

  <Tab title="US" icon="globe">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    curl -s \
      -H "Authorization: Bearer $KOSLI_API_TOKEN" \
      "https://app.us.kosli.com/api/v2/asserts/my-org/fingerprint/$SHA256?policy_name=has-tests&policy_name=has-review"
    ```
  </Tab>
</Tabs>

See the [Assert artifact API reference](/api-reference/asserts/assert-artifact) for the full response schema. You can also try it out directly in the API playground on that page.

## Enforce with a Kubernetes admission controller

A Kubernetes [validating admission webhook](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/) can call the Kosli assert API when a pod is created and reject pods whose images are non-compliant.

The flow is:

<Steps>
  <Step title="Pod creation triggers the webhook">
    Kubernetes calls your admission webhook before scheduling the pod.
  </Step>

  <Step title="Webhook extracts the image fingerprint">
    The webhook reads the container image reference from the pod spec and resolves its SHA256 digest.
  </Step>

  <Step title="Webhook calls the Kosli assert API">
    The webhook sends a request to the [assert endpoint](/api-reference/asserts/assert-artifact) with the fingerprint and the target environment name.
  </Step>

  <Step title="Webhook returns allow or deny">
    If `compliant` is `true`, the pod is admitted. If `false`, the webhook rejects the pod with a message explaining which policy requirements were not met.
  </Step>
</Steps>

<Note>
  **Experimental example:** [`kosli-dev/kosli-admission-webhook`](https://github.com/kosli-dev/kosli-admission-webhook) is a reference implementation of a Kubernetes admission webhook that asserts container image compliance in Kosli before scheduling. It is provided as an example to get you started and not a supported product — feedback is welcome!
</Note>

<Tip>
  The [Kosli K8S Reporter](/helm/k8s_reporter) reports what is running in your Kubernetes environments to Kosli. Pair it with an admission controller to both enforce and monitor compliance.
</Tip>

## What happens on failure

**CLI:** A non-compliant artifact causes `kosli assert artifact` to exit with a non-zero code. CI/CD pipelines treat this as a failed step and stop the deployment. Use `--output json` to get machine-readable compliance details.

**API:** The response body returns `compliant: false` with a `compliance_status` object describing which attestations are missing or non-compliant, and `policy_evaluations` listing per-policy results.


# Environments
Source: https://docs.kosli.com/getting_started/environments

Learn how to create and manage Kosli environments to track your runtime artifacts.

Kosli environments allow you to record the artifacts running in your runtime environments and how they change. Every time an environment change (or a set of changes) is reported, Kosli creates a new environment snapshot containing the status of the environment at a given point in time. The change record created in Kosli enables you to retrospectively perform runtime forensics about what ran where and when.

## Create an environment

You can create Kosli environments via the CLI, UI or the API. When you create an environment, you give it a name, a description and select its type.

<Warning>
  Make sure that type of Kosli environment matches the type of the environment you'll be reporting from.
</Warning>

<Tabs>
  <Tab title="CLI" icon="terminal">
    To create an environment via CLI, you would run a command like this:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create environment quickstart \
        --type docker \
        --description "quickstart environment for tutorial"
    ```

    See [kosli create environment](/client_reference/kosli_create_environment/) for CLI usage details and examples.
  </Tab>

  <Tab title="UI" icon="desktop">
    You can also create an environment directly from [app.kosli.com](https://app.kosli.com).

    * Make sure you've selected the organization you want to use from the orgs dropdown in the top left corner.
    * Click on `Environments` in the left navigation menu.
    * Click the `Add new environment` button
    * Fill in the environment name and description and select a type, then click `Save Environment`.

    After the new environment is created you'll be redirected to its page, which will initially have no snapshots. Once you start reporting your actual runtime environment to Kosli you'll be able to find snapshots and events (such as which artifacts started or stopped running) listed on that page.
  </Tab>
</Tabs>

## Snapshoting an environment

To record the current status of your environment you need to use the Kosli CLI to snapshot the running artifacts in it and report it to Kosli.
When Kosli receives an environment report, if the received list of running artifacts is different than what is in the latest environment snapshot, a new snapshot is created. Snapshots are immutable and can't be tampered with.

Currently, the following environment types are supported:

* Kubernetes
* Docker
* Paths on a server
* AWS Simple Storage Service (S3)
* AWS Lambda
* AWS Elastic Container Service (ECS)
* Azure Web Apps and Function Apps
* Google Cloud Run (services and jobs)

You can report environment snapshots manually using the `kosli snapshot [...]` commands for testing. For production use, however,  you would configure the reporting to happen automatically on regular intervals, e.g. via a cron job or scheduled CI job, or on certain events.

You can follow one of the tutorials below to setup automatic snapshot reporting for your environment:

* [Kubernetes environment reporting](/tutorials/report_k8s_envs)
* [AWS ECS/S3/Lambda environment reporting](/tutorials/report_aws_envs)
* [Cloud Run environment reporting](/tutorials/report_cloud_run_envs)

### Snapshotting scopes

Depending on the type of your environment, you can scope what to snapshot from the environment. The following table shows the different scoping options currently available for different environment types:

| what to snapshot ->           | all resources | resources by names | resources by Regex | exclude by names | exclude by Regex |
| ----------------------------- | ------------- | ------------------ | ------------------ | ---------------- | ---------------- |
| ECS (clusters)                | √             | √                  | √                  | √                | √                |
| Lambda (functions)            | √             | √                  | √                  | √                | √                |
| S3 (buckets)                  |               |                    |                    |                  |                  |
| docker (containers)           | √             |                    |                    |                  |                  |
| k8s (namespaces)              | √             | √                  | √                  | √                | √                |
| azure (functions and apps)    | √             |                    |                    |                  |                  |
| cloud-run (services and jobs) | √             | √                  | √                  | √                | √                |

## Environment Compliance

An environment's compliance state is determined by its attached policies. The compliance state can be:

* <Badge>Compliant</Badge> - All artifacts in the snapshot satisfy the requirements defined in attached policies
* <Badge>Non-compliant</Badge> - One or more artifacts violate the requirements defined in attached policies
* <Badge>Unknown</Badge> - No policies are attached to the environment, compliance requirements are undefined

When you create a new environment, it starts with an <Badge>Unknown</Badge> compliance state since no policies are attached
by default. To establish compliance requirements, you need to attach at least one policy to the environment
(see [Environment Policies](/getting_started/policies))

<Note>
  If you detach all policies from an environment, its compliance state returns to <Badge>Unknown</Badge> since there are no longer any defined requirements for artifacts running in it.
</Note>

## Tagging environments

Tags are custom key-value pairs you attach to environments to categorize, filter, and add metadata. Common patterns include tagging by deployment stage (`tier=prod`), owning team (`team=platform`), or region (`region=eu-west-1`).

You can add tags via the CLI, Terraform, or the API:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli tag env production-k8s \
  --set tier=prod \
  --set team=platform \
  --set region=eu-west-1
```

Tags can also be referenced in [Environment Policy](/getting_started/policies) expressions to make attestation requirements conditional — for example, requiring security scans only for flows tagged `risk-level=high`.

For the full guide on managing tags, recommended patterns, and usage in policies, see [Managing Tags](/administration/managing_tags).

## Logical Environments

Logical environments are a way to group your Kosli environments so you can view all changes happening in your group in the same place. For example, if what you consider to be “Production” is a combination of a Kubernetes cluster, an S3 bucket, and a configuration file, you can combine the reports sent to these Kosli environments into a “Production” logical environment.

A logical environment can be created in the app or the CLI, and physical environments can be assigned to it in the app or with the [`kosli join environment`](/client_reference/kosli_join_environment/) command.


# Flows
Source: https://docs.kosli.com/getting_started/flows

Learn about Kosli Flows, how to create and manage them.

A Kosli Flow represents a business or software process that requires change tracking. It allows you to monitor changes across all steps within a process or focus specifically on a subset of critical steps.

<Note>
  In all the commands below we skip the required `--api-token` and `--org` flags for brevity. These can be set as described [here](/getting_started/install#assigning-flags-via-config-files).
</Note>

## Create a flow

To create a Flow, you can run:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create flow process-a --description "My SW delivery process" \
    --use-empty-template
```

## Flow template

When creating a Flow, you can optionally provide a `Flow Template`. This template defines the necessary steps within the business or software process represented by a Kosli Flow. The compliance of Flow trails and artifacts will be assessed using the template.

A Flow template is a YAML file following the syntax outlined in the [flow template spec](/template-reference/flow_template).

Here is an example:

```yml sw-delivery-template.yml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# yaml-language-server: $schema=https://docs.kosli.com/schemas/flow-template/v1.json
version: 1
trail:
  attestations:
  - name: jira-ticket
    type: jira
  artifacts:
  - name: backend
    attestations:
    - name: unit-tests
      type: junit
```

### Create a Flow with a template

To create a Flow with a template, you can run:

```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create flow process-a --description "My SW delivery process" \
 --template-file sw-delivery-template.yml
```

## Update a Flow

Rerunning the command with different description or template file will update the Flow.

See [kosli create flow](/client_reference/kosli_create_flow/) for more details.


# Install Kosli CLI
Source: https://docs.kosli.com/getting_started/install

Instructions to install Kosli CLI on various platforms

<Steps>
  <Step title="Choose your installation method">
    Kosli CLI can be installed from package managers,
    by Curling pre-built binaries, or can be used from the distributed Docker images.

    <Tabs>
      <Tab title="Script">
        You can download the correct Kosli CLI for your platform, given that you can run shell scripts on it, by invoking this one-line script:

        ```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        curl -fL https://raw.githubusercontent.com/kosli-dev/cli/refs/heads/main/install-cli.sh | sh
        ```
      </Tab>

      <Tab title="Docker">
        You can run the Kosli CLI with docker:

        ```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        docker run --rm ghcr.io/kosli-dev/cli:v{{< cli-version >}}
        ```

        The `entrypoint` for this container is the kosli command.

        To run any kosli command you append it to the `docker run` command above –
        without the `kosli` keyword. For example to run `kosli version`:

        ```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        docker run --rm ghcr.io/kosli-dev/cli:v{{< cli-version >}} version
        ```
      </Tab>

      <Tab title="Homebrew">
        If you have [Homebrew](https://brew.sh/) (available on MacOS, Linux or Windows Subsystem for Linux),
        you can install the Kosli CLI by running:

        ```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        brew install kosli-cli
        ```
      </Tab>

      <Tab title="APT">
        On Ubuntu or Debian Linux, you can use APT to install the Kosli CLI by running:

        ```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        sudo sh -c 'echo "deb [trusted=yes] https://apt.fury.io/kosli/ /"  > /etc/apt/sources.list.d/fury.list'
        # On a clean debian container/machine, you need ca-certificates
        sudo apt install ca-certificates
        sudo apt update
        sudo apt install kosli
        ```
      </Tab>

      <Tab title="YUM">
        On RedHat Linux, you can use YUM to install the Kosli CLI by running:

        ```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        cat <<EOT >> /etc/yum.repos.d/kosli.repo
        [kosli]
        name=Kosli public Repo
        baseurl=https://yum.fury.io/kosli/
        enabled=1
        gpgcheck=0
        EOT
        ```

        If you get mirrorlist errors (likely if you are on a clean centos container):

        ```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        cd /etc/yum.repos.d/
        sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-*
        sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-*
        ```

        ```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        yum update -y
        yum install kosli
        ```
      </Tab>

      <Tab title="curl">
        You can download the Kosli CLI from [GitHub](https://github.com/kosli-dev/cli/releases).
        Make sure to choose the correct tar file for your system.
        For example, on Mac with AMD:

        ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        curl -L https://github.com/kosli-dev/cli/releases/download/v{{< cli-version >}}/kosli_{{< cli-version >}}_darwin_amd64.tar.gz | tar zx
        sudo mv kosli /usr/local/bin/kosli
        ```
      </Tab>

      <Tab title="NPM">
        If you have [Node.js](https://nodejs.org/) (v18 or later), you can install the Kosli CLI globally via npm:

        ```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        npm install -g @kosli/cli
        ```

        Or using npx to run it without installing:

        ```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        npx @kosli/cli version
        ```
      </Tab>

      <Tab title="From source">
        You can build Kosli CLI from source by running:

        ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        git clone git@github.com:kosli-dev/cli.git
        cd cli
        make build
        ```
      </Tab>
    </Tabs>
  </Step>

  <Step title="Verifying the installation worked">
    Run this command:

    ```shell {.command} theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli version
    ```

    The expected output should be similar to this:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    version.BuildInfo{Version:"{{< cli-version >}}", GitCommit:"Homebrew", GitTreeState:"clean", GoVersion:"go1.23.4"}
    ```
  </Step>
</Steps>

<Info>
  New to Kosli? The [Kosli Learning Labs](/labs) provide a guided, project-based introduction covering Flows, Trails, attestations, and runtime compliance.
</Info>

## Using the CLI

The [CLI Reference](/client_reference/) section contains all the information you may need to run the Kosli CLI. The CLI flags offer flexibility for configuration and can be assigned in three distinct manners:

1. Directly on the command line.
2. Via environment variables.
3. Within a config file.

Among these options, priority is given in the following order: Option 1 holds the highest precedence, followed by Option 2, with Option 3 being the least prioritized.

### Assigning flags via environment variables

To assign a CLI flag using environment variables, generate a variable prefixed with KOSLI\_. Use the flag's name in uppercase and substitute any internal dashes with underscores. For instance:

* `--api-token` corresponds to `KOSLI_API_TOKEN`
* `--org` corresponds to `KOSLI_ORG`

### Assigning flags via config files

A config file is an alternative to using Kosli flags or environment variables.
You could use a config file for the values that rarely change - like API token or org,
but you can represent all Kosli flags in a config file.

Each key in the config file corresponds to the flag name, capitalized. For instance:

* `--api-token` would become `API-TOKEN`.
* `--org` would become `ORG`.

Config files can be written in JSON, YAML, or TOML formats.

To direct Kosli CLI to use a config file, employ the --config-file flag when executing Kosli commands. By default, the CLI looks for a config file called `kosli.<yaml/yml/json/toml>`

Below are examples of different config file formats:

<CodeGroup>
  ```json kosli-conf.json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  {
    "ORG": "my-org",
    "API-TOKEN": "123456abcdef"
  }
  ```

  ```yaml kosli-conf.yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  ORG: "my-org"
  API-TOKEN: "123456abcdef"
  ```

  ```toml kosli-conf.toml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  ORG = "my-org"
  API-TOKEN = "123456abcdef"
  ```
</CodeGroup>

When using the `--config-file` flag you can skip the file extension. For example,
to list environments with `org` and `api-token` in the configuration file you would run:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list environments --config-file=kosli-conf
```


# Environment Policies
Source: https://docs.kosli.com/getting_started/policies

Define and enforce compliance requirements for artifact deployments across different environments.

Environment Policies enable you to define and enforce compliance requirements for artifact deployments across
different environments. With Environment Policies, you can:

* Define specific requirements for each environment (e.g, dev, staging, prod)
* Enforce consistent compliance standards across your deployment pipeline
* Prevent non-compliant artifacts from being deployed (via admission controllers)

Policies are written in YAML and are immutable (updating a policy creates a new version). They can be attached to
one or more environments, and an environment can have one or more policies attached to it.

## Create a Policy

You can create a policy via CLI or via the API. Here is a basic policy that requires provenance and specific
attestations:

```yaml prod-policy.yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
_schema: https://docs.kosli.com/schemas/policy/v1
artifacts: # the rules apply to artifacts in an environment snapshot
  provenance:
    required: true # all artifacts must have provenance
  attestations:
    - name: dependency-scan # all artifacts must have dependency-scan attestation
      type: "*" # any attestation type
    - name: unit-test # all artifacts must have unit-test attestation
      type: junit # must be a 'junit' attestation type
```

You can create and manage policies using the Kosli CLI (global flags like org and api-token are omitted for brevity):

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create policy prod-requirements prod-policy.yaml
```

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get policy prod-requirements
```

See [kosli create policy](/client_reference/kosli_create_policy/) for usage details and examples.

<Note>
  Once you create a policy, you will be able to see it in the UI under `policies` in the left navigation menu.
</Note>

## Policy rules

A policy consists of rules which are applied to artifacts in an environment snapshot.

### Provenance

When `provenance` is set to `required: true`, the artifact must be part of a Kosli Flow (i.e., it must have
provenance information).

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
artifacts:
  provenance:
    required: true
```

### Trail compliance

When `trail-compliance` is set to `required: true`, the artifact must be part of a compliant Trail in its Flow.

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
artifacts:
  trail-compliance:
    required: true
```

### Specific attestations

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
artifacts:
  attestations:
    - name: "*" # attestation name can be anything
      type: pull-request
    - name: acceptance-test
      type: "*" # attestation type can be any built-in or existing custom type
    - name: security-scan
      type: snyk
    - name: coverage-metrics
      type: custom:my-coverage-metrics # custom attestation type
```

### Exceptions

You can add exceptions to policy rules using [policy expressions](/policy-reference/environment_policy#policy-expressions).

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
_schema: https://docs.kosli.com/schemas/policy/v1

artifacts:
  provenance:
    required: true
    exceptions:
      # provenance is required except when one of the expressions evaluates to true
      - if: ${{ matches(artifact.name, "^datadog:.*") }}

  trail-compliance:
    required: true
    exceptions:
      - if: ${{ matches(artifact.name, "^datadog:.*") }}

  attestations:
    - if: ${{ flow.tags.risk-level == "high" }} # only required when expression is true
      name: unit-tests
      type: junit
```

For the complete YAML specification — fields, types, defaults, expression language, and constraints — see the [Environment Policy reference](/policy-reference/environment_policy).

## Attaching/Detaching Policies to/from Environments

Once you define your policies, you can attach them to environments via CLI or API:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attach-policy prod-requirements --environment=aws-production
```

To detach a policy from an environment:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli detach-policy prod-requirements --environment=aws-production
```

Any attachment/detachment operation automatically triggers an evaluation of the latest environment snapshot and
creates a new one with an updated compliance state.

<Note>
  If you detach all attached policies from an environment, the environment compliance state will become <Badge>Unknown</Badge> since there are no longer any defined requirements for artifacts running in it. The environment will continue to
  track snapshots, but its compliance cannot be evaluated without policies.
</Note>

## Enforcing policies

Once policies are attached to environments, you can enforce them as deployment gates in your CI/CD pipeline, via the API, or with a Kubernetes admission controller. See [Enforce policies](/getting_started/enforce_policies) for setup instructions.


# Trails
Source: https://docs.kosli.com/getting_started/trails

Learn about Kosli Trails, how to create and manage them.

Every time you execute a process represented by a Kosli Flow, you would initiate a `trail` to record the changes made during that specific execution.

You have the flexibility to determine the boundaries of what you consider a single execution of your process. For instance, in a software delivery process, an execution instance might be defined by:

<AccordionGroup>
  <Accordion title="Git commits" icon="code-commit">
    The trail represents changes recorded from a single commit (as reported from CI).
  </Accordion>

  <Accordion title="Pull requests" icon="code-pull-request">
    The trail represents changes recorded throughout the life of a single pull request (can span multiple commits).
  </Accordion>

  <Accordion title="Jira or Github issues" icon="list-check">
    The trail represents changes recorded throughout the life of a single ticket/issue (can span multiple pull requests and commits).
  </Accordion>
</AccordionGroup>

Each trail must possess a unique name within the Flow. This name typically follows a custom pattern, depending on how you define the scope of a single process execution.

## Begin a trail

To begin a Trail, you can run a command similar to the one below:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli begin trail trail-1 --flow process-1 --description "My first trail"
```

Rerunning the command with different description or template file will update the Trail.

See [kosli begin trail](/client_reference/kosli_begin_trail/) for more details.

<Note>
  You can overwrite the flow template for each trail using `--template-file`.
  By default, the trail inherits the template from its Flow.
</Note>


# GitHub Action
Source: https://docs.kosli.com/github-action-reference/setup_cli_action

Reference for the setup-kosli-cli GitHub Action that installs the Kosli CLI on GitHub Actions runners.

The [`kosli-dev/setup-cli-action`](https://github.com/kosli-dev/setup-cli-action) GitHub Action (`setup-kosli-cli`) installs the [Kosli CLI](/client_reference) on GitHub Actions runners. After the action runs, every CLI command is available in later steps of the job.

The action runs on `ubuntu-latest`, `windows-latest`, and `macos-latest` runners.

<Note>
  This page documents the action itself. For a broader guide to using Kosli in GitHub Actions, including the command flags that are defaulted from GitHub CI variables, see [CI/CD](/integrations/ci_cd).
</Note>

## Usage

Install the latest release of the Kosli CLI:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
steps:
  - uses: kosli-dev/setup-cli-action@v5
```

Install a specific version:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
steps:
  - name: Setup Kosli CLI
    uses: kosli-dev/setup-cli-action@v5
    with:
      version: 2.11.43
```

## Inputs

| Input          | Required | Default               | Description                                                                                                                       |
| :------------- | :------- | :-------------------- | :-------------------------------------------------------------------------------------------------------------------------------- |
| `version`      | No       | `latest`              | Version of the Kosli CLI to install. See [Version selection](#version-selection).                                                 |
| `github-token` | No       | `${{ github.token }}` | Token used to authenticate the GitHub API calls that resolve `latest` or a major/minor pin. You normally do not need to set this. |

## Outputs

| Output    | Description                                                                                                                                                        |
| :-------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `version` | The resolved Kosli CLI version that was installed. When `version` is `latest` or a major/minor pin, this is the concrete semver that was selected (e.g. `2.12.0`). |

Reference the resolved version in later steps:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
steps:
  - name: Setup Kosli CLI
    id: setup
    uses: kosli-dev/setup-cli-action@v5

  - name: Print installed version
    run: echo "Installed Kosli CLI ${{ steps.setup.outputs.version }}"
```

## Version selection

The `version` input accepts:

* **A full semver**, e.g. `2.11.43` — installed as-is.
* **A major pin**, e.g. `"2"` — resolves to the newest stable `2.x` release, and never `3.0.0`.
* **A major.minor pin**, e.g. `"2.11"` — resolves to the newest stable `2.11.z` patch.
* **`latest`** — resolves to the newest stable release of [`kosli-dev/cli`](https://github.com/kosli-dev/cli). This is the default.

Major and minor pins resolve at runtime and never select a pre-release or a higher major.

<Warning>
  Quote partial versions. In YAML, `version: 2.10` is parsed as the number `2.1`, which is not what you mean. Always quote a major or minor pin: `version: "2"`, `version: "2.10"`.
</Warning>

Track a major version and pick up every update within it without ever jumping to the next (breaking) major:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
steps:
  - name: Setup Kosli CLI
    uses: kosli-dev/setup-cli-action@v5
    with:
      version: "2"   # newest stable 2.x, never 3.x
```

## Example job

Secrets in GitHub Actions are not automatically exported as environment variables, so set the API token explicitly. All CLI flags can be set as environment variables by adding the `KOSLI_` prefix and capitalizing them.

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
jobs:
  build-image:
    runs-on: ubuntu-latest
    env:
      KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }}
      KOSLI_ORG: my-org
      KOSLI_FLOW: my-flow
      KOSLI_TRAIL: ${{ github.sha }}
      IMAGE_NAME: my-registry/my-image:latest
    steps:
      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: ${{ env.IMAGE_NAME }}

      - name: Setup Kosli CLI
        uses: kosli-dev/setup-cli-action@v5

      - name: Attest image provenance
        run: kosli attest artifact "${IMAGE_NAME}" --artifact-type=oci
```

For a complete example of a GitHub workflow using Kosli, see the Kosli CLI's [own workflow](https://github.com/kosli-dev/cli/blob/main/.github/workflows/docker.yml).

## References

* Action source: [`kosli-dev/setup-cli-action`](https://github.com/kosli-dev/setup-cli-action)
* Marketplace listing: [setup-kosli-cli](https://github.com/marketplace/actions/setup-kosli-cli)
* [CI/CD integration guide](/integrations/ci_cd)
* [Kosli CLI reference](/client_reference)


# Configuration reference
Source: https://docs.kosli.com/helm/k8s_reporter/configuration

All values.yaml options for the Kosli k8s-reporter Helm chart.

## General

<ParamField type="object">
  Affinity rules for scheduling the reporter pod. Supports nodeAffinity, podAffinity and podAntiAffinity.
</ParamField>

<ParamField type="string">
  Specifies how to treat concurrent executions of a Job that is created by this CronJob.
</ParamField>

<ParamField type="string">
  The cron schedule at which the reporter is triggered to report to Kosli.
</ParamField>

<ParamField type="int">
  Specifies the number of failed finished jobs to keep.
</ParamField>

<ParamField type="string">
  Overrides the fullname used for the created k8s resources. It has higher precedence than `nameOverride`.
</ParamField>

<ParamField type="string">
  Overrides the name used for the created k8s resources. If `fullnameOverride` is provided, it has higher precedence than this one.
</ParamField>

<ParamField type="object">
  Node labels for scheduling the reporter pod. On EKS with Karpenter, use this to pin the reporter to a stable managed node group (e.g. `eks.amazonaws.com/nodegroup: <name>`) so it does not interfere with node consolidation. See [Running on EKS with Karpenter](/helm/k8s_reporter/karpenter).
</ParamField>

<ParamField type="object">
  Annotations to add to the CronJob object itself. For pod-level annotations (added to each reporter pod), use `podTemplateAnnotations` instead.
</ParamField>

<ParamField type="object">
  Custom labels to add to pods.
</ParamField>

<ParamField type="object">
  Annotations to add to the reporter pod template (applied to each Job pod that the CronJob creates).
</ParamField>

<ParamField type="int">
  Specifies the number of successful finished jobs to keep.
</ParamField>

<ParamField type="list">
  Tolerations for scheduling the reporter pod, e.g. to run on a dedicated or tainted node group.
</ParamField>

## Image

<ParamField type="string">
  The kosli reporter image pull policy.
</ParamField>

<ParamField type="string">
  The kosli reporter image repository.
</ParamField>

<ParamField type="string">
  The kosli reporter image tag, overrides the image tag whose default is the chart appVersion.
</ParamField>

## Reporter configuration

<ParamField type="bool">
  Create each Kosli environment (type K8S) if it does not already exist, before reporting the snapshot.
</ParamField>

<ParamField type="bool">
  Whether the dry run mode is enabled or not. In dry run mode, the reporter logs the reports to stdout and does not send them to kosli.
</ParamField>

<ParamField type="string">
  Description applied to every environment auto-created in this run. Only used when `autoEnvironment` is true; existing environments are never modified. Note: a single value is shared by all environments created during the run.
</ParamField>

<ParamField type="list">
  List of Kosli environments to report to. Each entry has required 'name' and optional namespace selectors. Use one entry to report a single environment; use multiple entries to report to multiple environments with different selectors. Per entry: name (required), namespaces, namespacesRegex, excludeNamespaces, excludeNamespacesRegex (optional). Leave namespace fields unset for an entry to report the entire cluster to that environment.
</ParamField>

<ParamField type="string">
  The http proxy url.
</ParamField>

<ParamField type="boolean">
  **Deprecated and ignored** — used to control whether scaling (replica count) changes were recorded for environments auto-created in this run. Scaling events no longer trigger new snapshots and an environment can no longer have scaling capture turned on, so the `--include-scaling` / `--exclude-scaling` flags this passed to the CLI had stopped having any effect. As of chart version 2.7.0 the flags are no longer passed. Setting this value does nothing; remove it from your values.
</ParamField>

<ParamField type="string">
  The name of the Kosli org.
</ParamField>

<ParamField type="object">
  The security context for the reporter cronjob. Set to null or  to disable security context entirely (not recommended). For OpenShift with SCC, explicitly set runAsUser to null to let OpenShift assign the UID from the allowed range. Simply omitting runAsUser from your values override will not work because Helm deep-merges with these defaults. Example OpenShift override:   securityContext:     allowPrivilegeEscalation: false     runAsNonRoot: true     runAsUser: null.
</ParamField>

<ParamField type="bool">
  Whether to allow privilege escalation.
</ParamField>

<ParamField type="bool">
  Whether to run as non root.
</ParamField>

<ParamField type="int">
  The user id to run as. For OpenShift environments with SCC, set to null (runAsUser: null) to allow automatic UID assignment. Simply omitting this field will not work due to Helm's deep merge with chart defaults.
</ParamField>

## Kosli API token

<ParamField type="string">
  The name of the key in the secret data which contains the Kosli API token.
</ParamField>

<ParamField type="string">
  The name of the secret containing the kosli API token.
</ParamField>

## Environment variables

<ParamField type="object">
  Map of plain environment variables to inject into the reporter container. For a single-tenant Kosli instance, set `KOSLI_HOST` to `https://INSTANCE_NAME.kosli.com`.
</ParamField>

<ParamField type="list">
  Additional environment variables to inject into the reporter container. List of `{name, value}` or `{name, valueFrom}` entries, rendered verbatim into the container env. Supports plain values and valueFrom (`secretKeyRef` / `configMapKeyRef`). Note: entries here are appended after the chart's own env entries; on duplicate names the later entry wins.
</ParamField>

## Volumes

<ParamField type="list">
  Additional container-level volumeMounts for the reporter container. Rendered verbatim into the container spec alongside the chart's own mounts.
</ParamField>

<ParamField type="list">
  Additional Pod-level volumes to attach to the reporter pod. Rendered verbatim into the Pod spec alongside the chart's own volumes. Use together with `extraVolumeMounts` to mount Secrets, ConfigMaps, or other volumes into the container.
</ParamField>

## Custom CA

<ParamField type="object">
  Convenience wrapper for mounting a corporate / custom CA bundle. See [Running behind a TLS-inspecting proxy](/helm/k8s_reporter/tls-proxy) for usage.
</ParamField>

<ParamField type="bool">
  Enable mounting a corporate/custom CA bundle into the trust store.
</ParamField>

<ParamField type="string">
  Key within the Secret that holds the PEM-formatted CA certificate (single cert or multi-cert PEM bundle).
</ParamField>

<ParamField type="string">
  Name of an existing Secret in the same namespace containing the CA bundle.
</ParamField>

## Resources

<ParamField type="string">
  The cpu limit.
</ParamField>

<ParamField type="string">
  The memory limit.
</ParamField>

<ParamField type="string">
  The memory request.
</ParamField>

## Service account

<ParamField type="object">
  Annotations to add to the service account.
</ParamField>

<ParamField type="bool">
  Specifies whether a service account should be created.
</ParamField>

<ParamField type="string">
  The name of the service account to use. If not set and create is true, a name is generated using the fullname template.
</ParamField>

<ParamField type="string">
  Specifies whether to create cluster-wide permissions for the service account or namespace-scoped permissions. Allowed values are: `cluster` or `namespace`.
</ParamField>

***

Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2).


# Installing the chart
Source: https://docs.kosli.com/helm/k8s_reporter/installing

Install the Kosli k8s-reporter Helm chart via the Kosli Helm repository.

To install this chart via the Helm chart repository:

<Steps>
  <Step title="Add the Kosli helm repo">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    helm repo add kosli https://charts.kosli.com/ && helm repo update
    ```
  </Step>

  <Step title="Create a secret for the Kosli API token">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kubectl create secret generic kosli-api-token --from-literal=key=<your-api-key>
    ```
  </Step>

  <Step title="Install the helm chart">
    Configure **reporterConfig.environments** (required). Each entry has required `name` and optional `namespaces`, `namespacesRegex`, `excludeNamespaces`, `excludeNamespacesRegex`. Omit namespace fields for an entry to report the entire cluster to that environment.

    **One environment, entire cluster:**

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    # values.yaml
    reporterConfig:
      kosliOrg: <your-org>
      environments:
        - name: <your-env-name>
    ```

    **One environment, specific namespaces:**

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    reporterConfig:
      kosliOrg: <your-org>
      environments:
        - name: <your-env-name>
          namespaces: [namespace1, namespace2]
    ```

    **Multiple environments with different selectors:**

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    reporterConfig:
      kosliOrg: <your-org>
      environments:
        - name: prod-env
          namespaces: [prod-ns1, prod-ns2]
        - name: staging-env
          namespacesRegex: ["^staging-.*"]
        - name: infra-env
          excludeNamespaces: [prod-ns1, prod-ns2, default]
    ```

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    helm install kosli-reporter kosli/k8s-reporter -f values.yaml
    ```
  </Step>
</Steps>

<Info>See all available options in the [configuration reference](/helm/k8s_reporter/configuration).</Info>


# Running on EKS with Karpenter
Source: https://docs.kosli.com/helm/k8s_reporter/karpenter

Keep the k8s-reporter out of Karpenter's way so nodes can still consolidate.

By default the reporter runs as a CronJob every 5 minutes. On clusters that use [Karpenter](https://karpenter.sh) for node autoscaling, this frequent scheduling can prevent nodes from being **consolidated** (scaled down).

The cause is Karpenter's `consolidateAfter` timer: Karpenter only consolidates a node once it has seen no pod scheduling activity on it for the configured window. A reporter pod arriving every 5 minutes keeps resetting that timer, so any node whose `consolidateAfter` is longer than the reporter interval never becomes eligible for consolidation (see [karpenter#1921](https://github.com/kubernetes-sigs/karpenter/issues/1921)). This is Karpenter working as designed, not a reporter bug.

Frequent snapshots are what let Kosli surface drift or an unauthorized change quickly, so the best fix keeps the 5-minute cadence and moves the reporter out of Karpenter's way. Widening the interval trades away that detection speed and should be a last resort.

## 1. Pin the reporter to a stable node group (recommended)

If you run a stable managed node group that Karpenter does not manage, schedule the reporter there so it never disturbs Karpenter-managed nodes. Use `nodeSelector`, and `tolerations` if that node group is tainted:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
nodeSelector:
  eks.amazonaws.com/nodegroup: system   # your managed node group

tolerations:
  - key: dedicated
    operator: Equal
    value: system
    effect: NoSchedule
```

To steer the reporter away from Karpenter-managed nodes instead, use `affinity` (a plain `nodeSelector` cannot express "not on these nodes"):

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
        - matchExpressions:
            - key: karpenter.sh/nodepool
              operator: DoesNotExist
```

## 2. Run the reporter out of the cluster

For zero footprint on cluster nodes, run `kosli snapshot k8s` on a schedule outside the cluster (for example a CI cron job) with kubeconfig access, keeping your reporting cadence without placing a pod on the cluster's nodes. See the [Kubernetes environment reporting tutorial](/tutorials/report_k8s_envs).

## 3. Widen the report interval (last resort)

Only if you cannot pin the reporter or move it out of cluster: set `cronSchedule` longer than your NodePool's `consolidateAfter` so nodes get quiet windows long enough to consolidate. This works, but a longer interval widens the window in which a change can go unreported, so prefer the options above.

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
cronSchedule: "*/15 * * * *"
```

<Warning>
  `karpenter.sh/do-not-disrupt: "true"` is **not** a fix here. It prevents Karpenter from disrupting the pod, which protects a mid-run report from interruption but makes consolidation of that node *less* likely, not more. Likewise `cluster-autoscaler.kubernetes.io/safe-to-evict` only affects the Kubernetes Cluster Autoscaler and is ignored by Karpenter.
</Warning>


# Kubernetes Reporter Helm Chart
Source: https://docs.kosli.com/helm/k8s_reporter/overview

A Helm chart for installing the Kosli K8s reporter as a CronJob.

<Info>
  This reference applies to **chart version 2.7.0**, which defaults to CLI **v2.36.1** via `appVersion`. Override with `image.tag`.
</Info>

A Helm chart for installing the Kosli K8s reporter as a CronJob.
The chart allows you to create a Kubernetes CronJob and all its necessary RBAC to report running images to Kosli at a given cron schedule.

Configuration is done via **reporterConfig.environments**: a list of Kosli environments to report to. Each entry has a required `name` and optional namespace selectors. Use one entry for a single environment, or multiple entries to report to different environments with different selectors.

<Note>Chart source can be found at [GitHub](https://github.com/kosli-dev/cli/tree/main/charts/k8s-reporter).</Note>

## In this section

<CardGroup>
  <Card title="Prerequisites" icon="clipboard-check" href="/helm/k8s_reporter/prerequisites" />

  <Card title="Installing the chart" icon="download" href="/helm/k8s_reporter/installing" />

  <Card title="Upgrading the chart" icon="arrow-up" href="/helm/k8s_reporter/upgrading" />

  <Card title="Uninstalling the chart" icon="trash" href="/helm/k8s_reporter/uninstalling" />

  <Card title="Running behind a TLS-inspecting proxy" icon="shield" href="/helm/k8s_reporter/tls-proxy" />

  <Card title="Running on EKS with Karpenter" icon="server" href="/helm/k8s_reporter/karpenter" />

  <Card title="Configuration reference" icon="gear" href="/helm/k8s_reporter/configuration" />
</CardGroup>


# Prerequisites
Source: https://docs.kosli.com/helm/k8s_reporter/prerequisites

Requirements for installing the Kosli k8s-reporter Helm chart.

* A Kubernetes cluster (minimum supported version is `v1.21`)
* Helm v3.0+
* If you want to report artifacts from just one namespace, you need to have permissions to `get` and `list` pods in that namespace.
* If you want to report artifacts from multiple namespaces or entire cluster, you need to have cluster-wide permissions to `get` and `list` pods.


# Running behind a TLS-inspecting proxy
Source: https://docs.kosli.com/helm/k8s_reporter/tls-proxy

Trust a corporate / custom CA bundle when running the k8s-reporter behind a TLS-inspecting proxy.

If your network sits behind a TLS-inspecting appliance (Zscaler, Netskope, Palo Alto, etc.) that re-signs HTTPS traffic with a corporate CA certificate, the reporter will fail with `x509: certificate signed by unknown authority`. To fix this, make the appliance's CA bundle available to the reporter.

The chart offers two ways to do this. Use whichever fits your deployment flow.

## Option 1 — customCA convenience wrapper (recommended for the common case)

<Steps>
  <Step title="Create a Secret containing the corporate CA certificate">
    PEM format, single cert or bundle:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kubectl create secret generic corporate-ca-bundle --from-file=ca.crt=/path/to/corporate-ca.crt
    ```
  </Step>

  <Step title="Enable the wrapper in values.yaml">
    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    customCA:
      enabled: true
      secretName: corporate-ca-bundle
      key: ca.crt
    ```
  </Step>
</Steps>

The chart mounts the certificate as a single file at `/etc/ssl/certs/kosli-custom-ca.crt` using `subPath`. Go's standard library on Linux loads CA roots in two independent passes — it reads the system bundle file (e.g. `/etc/ssl/certs/ca-certificates.crt`) and **also** scans `/etc/ssl/certs/` for additional certificate files. The mounted file is picked up by the directory scan and added to the trust store alongside the system roots, so no `SSL_CERT_FILE` env var is needed.

The wrapper deliberately does **not** set `SSL_CERT_FILE`. Setting it would replace the system bundle entirely with the customer's file, breaking trust for any public CAs the bundle does not include.

## Option 2 — generic extraVolumes / extraVolumeMounts / extraEnvVars

Use these when you need a non-default mount path, a ConfigMap instead of a Secret, multiple volumes, or any other shape the wrapper does not cover:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
extraVolumes:
  - name: corporate-ca
    secret:
      secretName: corporate-ca-bundle

extraVolumeMounts:
  - name: corporate-ca
    mountPath: /etc/ssl/certs/corporate
    readOnly: true
```

<Warning>
  If you mount the CA outside `/etc/ssl/certs/` and set `SSL_CERT_FILE` via `extraEnvVars`, your bundle must include the public CAs you also need to trust — Go uses only that file when `SSL_CERT_FILE` is set.
</Warning>

## Pod Security Standards

Both options use `secret`-backed volumes, which are permitted under the Pod Security Standards `restricted` profile. `hostPath` mounts are not permitted under that profile and should not be used here.

## Cluster-wide alternative

If you already run [cert-manager's trust-manager](https://cert-manager.io/docs/trust/trust-manager/) to distribute a corporate CA bundle into a well-known ConfigMap in every namespace, point `extraVolumes` / `extraVolumeMounts` at that ConfigMap instead of creating a per-namespace Secret.


# Uninstalling the chart
Source: https://docs.kosli.com/helm/k8s_reporter/uninstalling

Remove the Kosli k8s-reporter release from your cluster.

To remove the k8s-reporter release and its resources from your cluster:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
helm uninstall kosli-reporter
```


# Upgrading the chart
Source: https://docs.kosli.com/helm/k8s_reporter/upgrading

Upgrade an existing Kosli k8s-reporter release, including migration notes for v2.0.0.

## Breaking change in v2.0.0

Version 2.0.0 removes the previous single-environment mode (`kosliEnvironmentName` and the `namespaces` / `namespacesRegex` / `excludeNamespaces` / `excludeNamespacesRegex` flags). You now configure one or more environments only via **reporterConfig.environments**. To report a single environment, use a list with one entry.

If upgrading from v1.x to v2.0.0, migrate your values to the **environments** list format (see [Installing the chart](/helm/k8s_reporter/installing)).

## Deprecated and ignored in v2.7.0: `reporterConfig.includeScaling`

`reporterConfig.includeScaling` no longer has any effect. Scaling events do not trigger new snapshots, and an environment can no longer have scaling capture turned on, so the `--include-scaling` / `--exclude-scaling` flags this value passed to the CLI had already stopped doing anything — they only produced a deprecation warning in the reporter's logs on every run.

Version 2.7.0 stops passing them, which removes that warning. Nothing else changes: the reporter created environments with scaling off before this version and still does. The value is still accepted, but it does nothing and will be removed in a future major version. Remove it from your values.

## Upgrade command

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
helm upgrade kosli-reporter kosli/k8s-reporter -f values.yaml
```


# Application Developers
Source: https://docs.kosli.com/implementation_guide/phase_1/roles_and_responsibilities/app_developers

Role guide for Application Developers using Kosli

You build and maintain services, applications, or APIs that deliver customer or business value. You write code, push changes, and expect your work to move safely from commit to production.

You care about quality, security, and release velocity, but you do not want to be slowed down by compliance overhead.

# How Kosli helps you

Kosli captures the evidence that your changes have passed the right controls, like tests, code reviews, security scans, and approvals, so you can deploy with confidence and stay focused on building.

With Kosli, you can:

* Ship code without worrying about compliance gates or approval tickets
* Get clarity on why something cannot deploy, and what needs to happen
* Use existing CI workflows without learning new tools
* Trace what changed, where it went, and whether it passed all required controls

## Your role in using Kosli

As an application developer, you are a contributor to the system of record that Kosli observes. You may:

* Write code that passes through a Flow defined by your platform team
* Produce build artifacts and test results that Kosli records as evidence
* Trigger attestations through CI jobs (e.g., when tests run or scans complete)
* Occasionally check compliance status in the UI or via pull request checks

You are usually not responsible for setting up Kosli. It runs quietly underneath your normal delivery workflows.

## What you’ll Work with

You typically interact with Kosli through:

* **Your CI/CD pipeline**, which calls Kosli CLI under the hood
* **Pull requests or merge gates**, where Kosli may block or allow merges based on compliance
* **The Kosli UI**, to check deployment or compliance status if needed
* **Your platform team's guidance**, for understanding what evidence is expected

You do not need to memorize Kosli commands or manage configurations. Most of it is abstracted away by your Platform team

## What success looks like

* You write and commit code as usual, and your changes flow smoothly through CI and into production
* You do not need to fill out compliance tickets or wait for manual approvals
* If something is blocked, Kosli tells you what evidence is missing and how to resolve it
* You gain confidence that your work is secure and production-ready without extra effort

## Common questions you might have

<AccordionGroup>
  <Accordion title="Why did Kosli mark my build or deployment non-compliant?" icon="comment-question">
    Most likely a required check did not run, failed, or was not reported to Kosli. Your pipeline or platform team can help you identify what is missing.
  </Accordion>

  <Accordion title="Do I need to learn another CLI or tool?" icon="comment-question">
    No. Kosli is used behind the scenes by your platform team. You may see its results in PR checks or dashboards, but you do not need to run it manually.
  </Accordion>

  <Accordion title="How do I know if my change was successfully deployed?" icon="comment-question">
    You can use the Kosli UI to trace a git commit, artifact, or deployment. Kosli shows where it is running and what evidence was attached.
  </Accordion>

  <Accordion title="Can I use Kosli in debugging or incident response?" icon="comment-question">
    Yes. Kosli helps you trace what changed and when across environments. You can see exactly what was deployed and what passed or failed.
  </Accordion>
</AccordionGroup>

## Required Kosli User Roles

To perform the responsibilities described above, users in this role typically need:

* **Recommended role**: Member
* **Alternative role**: Reader (for developers who only need visibility)

Developers typically need to report attestations and manage flows for their applications. The Member role enables this. Some developers may only need visibility into deployments and compliance status, making the Reader role sufficient.

Learn more about [Kosli user roles and permissions](/administration/managing_users/roles_in_kosli).

## Where to start

* [**Getting Started**](): Follow this if you're curious about how Kosli works behind the scenes
* [**Querying Kosli**](): Learn how to search for artifacts or changes
* [**Concepts**](): Understand what Kosli tracks and why


# Overview
Source: https://docs.kosli.com/implementation_guide/phase_1/roles_and_responsibilities/overview

Define roles and responsibilities for Kosli implementation

Kosli supports multiple stakeholders across engineering, security, and compliance. Successful adoption depends on clear ownership and collaboration across roles.
This guide provides:

* A RACI matrix to define responsibilities per phase
* Role-by-role expectations during rollout
* Links to relevant documentation for each group

## <Icon icon="arrows-spin" /> Phases of Implementation

1. **Discovery and Planning:** Understand what to track, who is involved, and which flows to start with.
2. **Initial Setup and Pilot:** Configure Kosli for a single service or team. Validate the model and gather feedback.
3. **Rollout and Scale:** Extend flows and policies across teams and services. Standardize and automate.
4. **Governance and Optimization:** Measure success, refine policies, and prepare for audits with real data.

## <Icon icon="people-group" /> Stakeholders

1. **[Platform Engineers and DevOps](/implementation_guide/phase_1/roles_and_responsibilities/platform_engineers)**: Leads technical implementation and pipeline integration
2. **[Application Developer](/implementation_guide/phase_1/roles_and_responsibilities/app_developers)**: Builds code and produces evidence automatically
3. **[Security and Compliance](/implementation_guide/phase_1/roles_and_responsibilities/security_compliance)**: Defines control objectives and verifies evidence
4. **Sponsors**: Champions adoption, aligns on outcomes, and tracks impact

## <Icon icon="chart-candlestick" /> RACI Matrix

The RACI model helps teams and stakeholders know who to talk to, who drives a decision, and who just needs visibility. It’s especially helpful when rolling out tools like Kosli across multiple teams with different priorities and domain focus.

| Task                                | Platform Engineer | Application Developer | Security & Compliance | Sponsor |
| ----------------------------------- | ----------------- | --------------------- | --------------------- | ------- |
| Identify key flows and services     | R                 | C                     | C                     | A       |
| Define success criteria and metrics | C                 | C                     | C                     | A       |
| Select pilot team/service           | R                 | C                     | C                     | A       |
| Set up Kosli CLI and pipelines      | A                 | I                     | C                     | C       |
| Define attestation types            | R                 | C                     | A                     | C       |
| Configure environment snapshots     | A                 | I                     | C                     | C       |
| Set up environment policies         | R                 | I                     | A                     | C       |
| Validate compliance controls        | R                 | C                     | A                     | C       |
| Export and review audit packages    | C                 | I                     | A                     | C       |
| Roll out to additional teams        | R                 | C                     | C                     | A       |
| Track measures of success           | R                 | C                     | C                     | A       |

**Roles explained**

<AccordionGroup>
  <Accordion title="A: Accountable" icon="star">
    The owner of the outcome. This is the person who ensures the task is completed successfully, even if others do the work. There should only be one "A" per task.
  </Accordion>

  <Accordion title="R: Responsible" icon="check-circle">
    The doer. This person (or team) performs the work. They are hands-on with the implementation and execution of the task.
  </Accordion>

  <Accordion title="C: Consulted" icon="comment">
    Someone who provides input, guidance, or subject matter expertise. This is a two-way communication role. Their feedback is important for shaping the work.
  </Accordion>

  <Accordion title="I: Informed" icon="eye">
    Kept in the loop. This person doesn't need to be consulted during the task but should be notified of progress or outcomes. It's a one-way communication role.
  </Accordion>
</AccordionGroup>

## Connecting Responsibilities to Permissions

The RACI matrix above describes responsibilities during Kosli implementation. To perform these responsibilities, users need appropriate Kosli user roles (Admin, Member, Snapshotter, or Reader) assigned in the platform.

Kosli user roles control what actions someone can perform in the Kosli system:

* **Admin**: Full control, including user management and organization settings
* **Member**: Can create and modify resources, manage service accounts, and configure integrations
* **Snapshotter**: Can report environment snapshots, create environments, and manage service accounts, with read-only access to other resources
* **Reader**: Read-only access to view data and compliance status

For guidance on which Kosli user role to assign based on organizational responsibilities, see [Roles in Kosli](/administration/managing_users/roles_in_kosli) and [Mapping users to roles](/administration/managing_users/mapping_users_to_roles).


# Platform Engineers
Source: https://docs.kosli.com/implementation_guide/phase_1/roles_and_responsibilities/platform_engineers

Role guide for Platform and DevOps Engineers using Kosli

You build the internal tooling, workflows, and golden paths that help developers ship software reliably and securely. You care about scaling delivery without scaling your team.

If you’re supporting CI/CD pipelines, infrastructure, or compliance enablement across multiple services or teams, this page is for you.

## How Kosli helps you

Kosli gives you a single, unified way to track everything that moves through your delivery pipelines: code, artifacts, tests, approvals, deployments and prove it’s been done safely and correctly.

With Kosli, you can:

* Automate compliance and eliminate manual change approval processes.
* Capture tamper-proof evidence across your SDLC (without slowing down delivery).
* Monitor all runtime environments and deployments across teams.
* Offer developers secure paved paths that embed governance from the start.

## Your role in using Kosli

As a platform engineer, you're typically responsible for:

* Setting up Kosli in CI/CD and infrastructure environments.
* Creating and maintaining **Flows**, which model how changes move through pipelines.
* Defining and triggering **Trails** to capture each run of those pipelines.
* Configuring **Attestations** for tests, scans, and internal checks (e.g., Jira, Snyk).
* Capturing **Environment Snapshots** and enforcing **Policies** to govern deployments.
* Building reusable Kosli integrations (e.g., GitHub Actions, GitLab CI templates) so your dev teams don’t have to think about it.

You’ll often be the first person to integrate Kosli into your platform and roll it out to the rest of the org.

## What you’ll work with

You’ll primarily interact with:

* **Kosli CLI:** integrated into your CI/CD pipelines and scripts.
* **Flows** and **Trails:** to represent and track software delivery runs.
* **Artifacts** and **Attestations:** to connect builds and compliance evidence.
* **Environment Snapshots** & **Policies:** to enforce governance in prod and staging.
* **Kosli UI:** to review deployment status, compliance views, and audits.

If you're running Kubernetes, Terraform, or other infrastructure tools, Kosli also integrates easily to monitor state and changes.

## What success looks like

When Kosli is successfully adopted by platform engineering, you’ll see:

* Your pipelines continuously produce verifiable, compliant deployments.
* You eliminate the need for spreadsheet-driven approvals and CAB meetings.
* Developers onboard Kosli passively via the platform, they rarely have to learn it directly.
* Security and compliance teams get everything they need with minimal friction.
* Audits are a non-event: you already have the evidence.

## Common questions you might have

<AccordionGroup>
  <Accordion title="Do I need to change our pipelines to use Kosli?" icon="comment-question">
    No major changes. Kosli integrates via CLI commands you can drop into any pipeline.
  </Accordion>

  <Accordion title="Can I templatize this across many teams?" icon="comment-question">
    Yes. Use flow templates and reusable CI snippets to roll out a consistent setup.
  </Accordion>

  <Accordion title="Does Kosli work with our existing tools?" icon="comment-question">
    Almost certainly. Kosli is tool-agnostic and supports GitHub Actions, GitLab, Jenkins, Kubernetes, Terraform, and more.
  </Accordion>

  <Accordion title="How do I know it's working?" icon="comment-question">
    Kosli automatically gives you compliance status per environment and per change. You can inspect Trails, download audit packages, and integrate with Slack or through Webhooks for alerts.
  </Accordion>
</AccordionGroup>

## Required Kosli User Roles

To perform the responsibilities described above, users in this role typically need:

* **Recommended role**: Member
* **Alternative role**: Admin (for lead platform engineers managing organization-wide setup)

Platform engineers need to set up flows, manage service accounts, configure integrations, and implement Kosli across teams. The Member role provides these capabilities. Lead platform engineers who manage the overall organizational setup may require Admin access to manage users and organization settings.

Learn more about [Kosli user roles and permissions](/administration/managing_users/roles_in_kosli).

## Where to start

* [**Getting Started Guide**](): For a complete technical setup walkthrough.
* [**CLI Reference**](): Full list of commands.
* [**Concepts Overview**](): Understand how Flows, Trails, and Attestations fit together.


# Security and Compliance
Source: https://docs.kosli.com/implementation_guide/phase_1/roles_and_responsibilities/security_compliance

How security and compliance teams use Kosli to enforce controls and prepare for audits.

You are responsible for ensuring that software delivery meets regulatory, security, or internal governance requirements. You translate frameworks like SOC 2, ISO 27001, or custom internal controls into practical expectations for teams.

You may work in AppSec, GRC, risk management, or a compliance function. You care about provable controls, trustworthy evidence, and making audits repeatable and painless.

## How Kosli helps you

Kosli creates a continuous, tamper-proof record of how software changes move through your organization. It captures real evidence for controls like peer review, test coverage, security scanning, and approval steps, all without relying on spreadsheets or screenshots.

With Kosli, you can:

* Automatically collect and store control evidence for every change
* Get instant visibility into which changes are compliant and which are not
* Replace change request tickets with actual audit-ready data
* Export audit packages in seconds for any service, environment, or release

## Your role in using Kosli

You help define what counts as compliant. Kosli helps you enforce that through policy and automation. Your responsibilities may include:

* Working with platform teams to translate controls into **Attestations** and **Policies**
* Reviewing **Environment** or **Trail** compliance reports
* Verifying that changes meet requirements for deployment to sensitive environments
* Preparing for or responding to internal and external audits using Kosli data

You may not configure pipelines directly, but you rely on Kosli’s outputs to validate that controls are working.

## What you’ll work with

You interact with Kosli through:

* **The Kosli UI**, where you can see compliance status per environment, service, or release
* **Audit Packages**, which you can export to support internal reviews or formal audits
* **Attestation** and **Policy** definitions, often managed in collaboration with platform or security engineering teams
* **Environment Snapshots**, which show what is running and why it is or is not compliant

You may also use the **CLI** or **API** if you need detailed reports or integrations.

## What success looks like

* You can prove to auditors or regulators that your SDLC is secure and compliant
* Controls are codified and enforced consistently across all delivery pipelines
* You no longer chase teams for screenshots or spreadsheets during audits
* You have full traceability from change request to deployed artifact with supporting evidence

## Common questions you might have

<AccordionGroup>
  <Accordion title="How do I know a change is compliant?" icon="comment-question">
    Kosli validates Trails and Environments based on policies and recorded attestations. You can view compliant and non-compliant changes in the UI or export audit reports.
  </Accordion>

  <Accordion title="Can we map Kosli data to our compliance framework?" icon="comment-question">
    Yes. Attestations can represent any type of control evidence, such as test results, PR approvals, vulnerability scans, or change reviews.
  </Accordion>

  <Accordion title="How secure is the evidence?" icon="comment-question">
    Kosli stores all records immutably and securely. Attestations can include signed metadata and attachments, stored in a tamper-evident Evidence Vault.
  </Accordion>

  <Accordion title="How do I use Kosli in an audit?" icon="comment-question">
    You can export a complete Audit Package for any Trail, Artifact, or Environment. This includes all recorded evidence and metadata for traceable, reviewable compliance.
  </Accordion>
</AccordionGroup>

## Required Kosli User Roles

To perform the responsibilities described above, users in this role typically need:

* **Recommended role**: Admin

Security and compliance teams need to manage policies, review audit data, control user access, and configure organization-wide settings. The Admin role is required for these governance responsibilities, including the ability to manage users, define policies, and ensure proper access controls are in place.

Learn more about [Kosli user roles and permissions](/administration/managing_users/roles_in_kosli).

## Where to start

* [**How Kosli works**](/understand_kosli/how_kosli_works): Understand how Flows, Trails, and Attestations fit together.


# Sponsors
Source: https://docs.kosli.com/implementation_guide/phase_1/roles_and_responsibilities/sponsors

How Sponsors can use Kosli to drive safe and compliant software delivery at speed.

You’re responsible for making sure your organization delivers software quickly, safely, and in a way that satisfies regulatory, customer, or internal compliance expectations.

You might lead an engineering org, oversee platform strategy, or be responsible for DevSecOps or governance transformation. You care about reducing lead time without sacrificing control or trust.

## How Kosli helps you

Kosli gives your teams the ability to automate governance across the entire software delivery lifecycle (SDLC). It makes it easy to verify that changes have passed the right checks and policies without slowing down releases.

With Kosli, you can:

* Replace manual approvals and change control boards with real-time, automated evidence
* Give your platform and product teams compliant workflows by default
* Get instant answers to “what changed, where, and why” across all environments
* Demonstrate governance and audit readiness without adding burden to developers

## Your role in using Kosli

As a sponsor, you are the enabler. You set the strategic direction and ensure the right people are equipped to succeed. Your key responsibilities include:

* Aligning Kosli adoption with organizational goals around speed, safety, and compliance
* Supporting platform teams in rolling out Kosli at scale
* Communicating the value of automated governance across the organization
* Using Kosli dashboards or reports to track adoption, policy health, and delivery confidence

## What you’ll work with

You won’t typically use the CLI. Instead, your interaction with Kosli will focus on:

* The Kosli UI to view environment compliance, trail status, and audit readiness
* Dashboards to understand where controls are working or missing
* Audit Packages and Evidence Vault exports to support reporting or audits
* Occasional reference to Kosli’s terminology or data model when aligning internal processes

## What success looks like

* You have visibility into delivery health and compliance posture across the org
* Product and platform teams operate with fewer manual gates or surprises
* You can demonstrate governance to stakeholders without relying on ad hoc processes
* Audits are predictable and repeatable
* Kosli becomes a quiet enabler. Developers deliver, compliance is provable, and your platform team scales without friction

## Common questions you might have

<AccordionGroup>
  <Accordion title="Can we remove manual approvals without increasing risk?" icon="comment-question">
    Yes. Kosli automates evidence collection and policy enforcement, reducing the need for manual checks while maintaining control.
  </Accordion>

  <Accordion title="Does this help us with [SOC 2 / ISO / internal controls]?" icon="comment-question">
    Yes. Kosli maps technical events to audit-friendly records, with downloadable audit packages and policy enforcement.
  </Accordion>

  <Accordion title="Will this add overhead for my teams?" icon="comment-question">
    No. Platform engineers handle setup and integration. Developers rarely need to interact with Kosli directly.
  </Accordion>

  <Accordion title="How can I measure success?" icon="comment-question">
    You'll see reduced lead times, fewer compliance exceptions, and improved audit efficiency. Kosli makes this visible through environment compliance views and evidence tracking.
  </Accordion>
</AccordionGroup>

## Required Kosli User Roles

To perform the responsibilities described above, users in this role typically need:

* **Recommended role**: Reader

Sponsors need visibility into adoption progress, compliance status, and overall system health but don't need to make technical changes. The Reader role provides necessary oversight without operational access, allowing you to view dashboards, compliance reports, and audit data.

Learn more about [Kosli user roles and permissions](/administration/managing_users/roles_in_kosli).

## Where to Start

* [**What is Kosli?**](understand_kosli/what_is_kosli/): Understand the value and core ideas
* [**Implementing Kosli**](/implementation_guide): A rollout guide aligned to business and technical outcomes
* [**How Kosli works**](/understand_kosli/how_kosli_works): Understand how Flows, Trails, and Attestations fit together


# Attestation Types
Source: https://docs.kosli.com/implementation_guide/phase_2/plan_organizational_structure/naming_conventions/attestation_types

Naming convention guidance for custom attestation types following the control-objective, evidence-type, detail, and version pattern.

Use clear, descriptive names for custom attestation types to indicate what kind of evidence they represent.

Naming convention relates to `TYPE-NAME` in Kosli CLI command:

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create attestation-type TYPE-NAME [flags]
```

See [CLI documentation](/client_reference/kosli_create_attestation-type) for more details.

**Name Convention:** `control objective`-`evidence type`-`[detail]`-`[version]`

* **control objective**: The high-level control or requirement the attestation supports (e.g., control id, code review, security scan, unit test)
* **evidence type**: The specific type of evidence being attested (e.g. tool-name, test-suite)
* **detail (Optional)**: Additional context or detail about the attestation (e.g., type, severity-level, environment, etc.)
* **version (Optional)**: The version of the attestation type or schema. Should follow semantic versioning (e.g., v1, v2)

<Info>
  - `detail` element may be repeated to add finer granularity if needed.
  - You can skip `detail` and `version` if not needed for your use case.
  - Kosli versions attestation types automatically, so `version` is often unnecessary. However, it can be useful for multiple version running at the same time, for example in shared pipelines.
</Info>

<Tabs>
  <Tab title="snake_case">
    **Examples on `TYPE-NAME`:**

    * `bc1-version_control-v1` (BC1 version control attestation, version 1)
    * `code_review-github-pr` (basic code review attestation)
    * `security_scan-snyk-high` (Custom schema for Snyk scan with high severity detail)
    * `unit_test-junit-detail1-detail2-v2` (Multiple detail blocks with version)

    **Regex:**

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    ^[a-z][a-z0-9_]*-[a-z][a-z0-9_]*(-[a-z][a-z0-9_]*)*(-v[1-9][0-9]*)?$
    ```
  </Tab>

  <Tab title="camelCase">
    **Examples on `TYPE-NAME`:**

    * `bc1-versionControl-v1` (BC1 version control attestation, version 1)
    * `codeReview-github-pr` (basic code review attestation)
    * `securityScan-snyk-high` (Custom schema for Snyk scan with high severity detail)
    * `unitTest-junit-detail1-detail2-v2` (Multiple detail blocks with version)

    **Regex:**

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    ^[a-z][a-zA-Z0-9]*-[a-z][a-zA-Z0-9]*(-[a-z][a-zA-Z0-9]*)*(-v[1-9][0-9]*)?$
    ```
  </Tab>

  <Tab title="PascalCase">
    **Examples on `TYPE-NAME`:**

    * `Bc1-VersionControl-V1` (BC1 version control attestation, version 1)
    * `CodeReview-Github-Pr` (basic code review attestation)
    * `SecurityScan-Snyk-High` (Custom schema for Snyk scan with high severity detail)
    * `UnitTest-Junit-Detail1-Detail2-V2` (Multiple detail blocks with version)

    **Regex:**

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    ^[A-Z][a-zA-Z0-9]*-[A-Z][a-zA-Z0-9]*(-[A-Z][a-zA-Z0-9]*)*(-V[1-9][0-9]*)?$
    ```
  </Tab>
</Tabs>


# Flows and Trails
Source: https://docs.kosli.com/implementation_guide/phase_2/plan_organizational_structure/naming_conventions/flows_and_trails

Recommended naming conventions for Flows and Trails in Kosli.

This document outlines recommended naming conventions for Flows and Trails as they closely relate to each other in Kosli. Adopting these conventions will help maintain clarity and consistency across your organization.

## Flows

A clear naming convention transforms a simple ID into a meaningful identifier that everyone understands. This shared language ensures attestations go to the right place and you can track your releases from start to finish.

The naming convention relates to `FLOW-NAME` in Kosli CLI command:

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create flow FLOW-NAME [flags]
```

See [CLI documentation](client_reference/kosli_create_flow) for more details.

The following sections define conventions for the two main types of Flows in Kosli: Build Flows and Release Flows.

### Build Flows

Represent how code changes move from commit to artifact.

**Convention:** <Badge>org unit</Badge> - <Badge>repo</Badge>-<Badge>\[service]</Badge>

<ParamField type="string">
  Your organizational unit, division or team name
</ParamField>

<ParamField type="string">
  Your repository name
</ParamField>

<ParamField type="string">
  The specific service or component that the artifact belongs to

  <Tip>
    You can skip `service` if your repository produces only one artifact, i.e. non-monorepo setups.
  </Tip>
</ParamField>

<Accordion title="examples on FLOW-NAME">
  <Tabs>
    <Tab title="snake_case">
      * `investment-web_app` (single artifact)
      * `investment-web_app-frontend` (with service: frontend)
      * `devops_team-mobile_app-backend` (with service: backend)

      **Regex:**

      ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      ^[a-z][a-z0-9_]*-[a-z][a-z0-9_]*(-[a-z][a-z0-9_]*)?$
      ```
    </Tab>

    <Tab title="camelCase">
      * `investment-webApp` (single artifact)
      * `investment-webApp-frontend` (with service: frontend)
      * `devopsTeam-mobileApp-backend` (with service: backend)

      **Regex:**

      ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      ^[a-z][a-zA-Z0-9]*-[a-z][a-zA-Z0-9]*(-[a-z][a-zA-Z0-9]*)?$
      ```
    </Tab>

    <Tab title="PascalCase">
      * `Investment-WebApp` (single artifact)
      * `Investment-WebApp-Frontend` (with service: frontend)
      * `DevOpsTeam-MobileApp-Backend` (with service: backend)

      **Regex:**

      ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      ^[A-Z][a-zA-Z0-9]*-[A-Z][a-zA-Z0-9]*(-[A-Z][a-zA-Z0-9]*)?$
      ```
    </Tab>
  </Tabs>
</Accordion>

### Release Flows

Represent how artifacts move from binary repository to deployment.

**Name Convention:** `org unit`-`repo`

<ParamField type="string">
  Your organizational unit, division or team name
</ParamField>

<ParamField type="string">
  Your repository name
</ParamField>

<Accordion title="examples on FLOW-NAME">
  <Tabs>
    <Tab title="snake_case">
      * `investment-web_app`
      * `devops_team-mobile_app`

      **Regex:**

      ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      ^[a-z][a-z0-9_]*-[a-z][a-z0-9_]*$
      ```
    </Tab>

    <Tab title="camelCase">
      * `investment-webApp`
      * `devopsTeam-mobileApp`

      **Regex:**

      ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      ^[a-z][a-zA-Z0-9]*-[a-z][a-zA-Z0-9]*$
      ```
    </Tab>

    <Tab title="PascalCase">
      * `Investment-WebApp`
      * `DevOpsTeam-MobileApp`

      **Regex:**

      ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      ^[A-Z][a-zA-Z0-9]*-[A-Z][a-zA-Z0-9]*$
      ```
    </Tab>
  </Tabs>
</Accordion>

## Trails

The naming convention for Trails depends on the type of Flow they are associated with: Build Flows or Release Flows and relates to `TRAIL-NAME` in Kosli CLI command:

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli begin trail TRAIL-NAME \
  --flow FLOW-NAME \ # Build or Release Flow
  [other flags]
```

See [CLI documentation](client_reference/kosli_begin_trail) for more details.

### Associated with [Build Flows](#build-flows)

**Name Convention:** `sha`

<ParamField type="string">
  The Git commit HEAD SHA that triggered the build.
</ParamField>

<Accordion title="examples on TRAIL-NAME">
  <Note>
    Casing does not matter for SHA values, so we do not provide multiple casing options here.
  </Note>

  * `abcdef1234567890abcdef1234567890abcdef12` (full 40-char SHA)
  * `abcdef123` (short SHA)

  **Regex:**

  ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  ^[a-f0-9]+$
  ```
</Accordion>

### Associated with [Release Flows](#release-flows)

**Convention:** <Badge>env</Badge> - <Badge>pr number</Badge>

<ParamField type="string">
  The target deployment environment (e.g., staging, production)
</ParamField>

<ParamField type="string">
  The pull request or change request number associated with the deployment.
</ParamField>

<Accordion title="examples on TRAIL-NAME">
  <Tabs>
    <Tab title="snake_case">
      * `staging-42`
      * `production-108`

      **Regex:**

      ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      ^[a-z][a-z0-9_]*-[0-9]+$
      ```
    </Tab>

    <Tab title="camelCase">
      * `staging-42`
      * `production-108`

      **Regex:**

      ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      ^[a-z][a-zA-Z0-9]*-[0-9]+$
      ```
    </Tab>

    <Tab title="PascalCase">
      * `Staging-42`
      * `Production-108`

      **Regex:**

      ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      ^[A-Z][a-zA-Z0-9]*-[0-9]+$
      ```
    </Tab>
  </Tabs>
</Accordion>


# Overview
Source: https://docs.kosli.com/implementation_guide/phase_2/plan_organizational_structure/naming_conventions/overview

Best practices for naming Flows, Attestation Types, and Environments in Kosli.

Clear and consistent naming makes it easy for everyone to understand what each item in Kosli represents. Good names help you route attestations correctly and quickly find what you need.

Use these conventions for:

* **Flows** and **Trails**
* **Attestation Types**
* **Environments**

## General Guidelines

The general guidelines should be considered best practices for all naming conventions in Kosli. You can adapt them to fit your organization’s needs, but consistency is key. All of our proposed conventions follow these general guidelines:

**Structure**: `<element 1>` `<delimiter>` `<element 2>` `<delimiter>`...`<element N>`

<Steps>
  <Step title="Choose delimiter">
    Choose a delimiter that works for your and stick with it consistently.
    For example hyphen `-`, underscore `_`, tilde `~` or dot `.`.
    Avoid mixing delimiters within the same naming scheme.
  </Step>

  <Step title="Choose case style for elements">
    Choose a meaningful case style across elements (e.g., PascalCase, camelCase, snake\_case) and use it consistently. Avoid spaces and clashes with delimiters.
  </Step>

  <Step title="Keep it concise">
    Shorter names are easier to read and remember. Aim for concise but descriptive names.
  </Step>

  <Step title="Avoid special characters">
    Stick to alphanumeric characters and underscores/hyphens
  </Step>
</Steps>

<Warning>
  Be aware of using underscore `_` as the delimiter, as that conflicts with snake\_case for elements.
</Warning>

<Note>
  The rest of this document uses hyphen `-` as the delimiter in examples, but you can choose any delimiter that fits your needs.
</Note>

### Regular Expression

To help enforce these conventions programmatically, here are sample regular expressions you can use based on your chosen case style.

Adjust the regex if you choose a different delimiter.

<Tabs>
  <Tab title="snake_case">
    **Example**: `element_one`-`element_two`-`element_three`

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    ^[a-z][a-z0-9_]*(-[a-z][a-z0-9_]*)*$
    ```
  </Tab>

  <Tab title="camelCase">
    **Example**: `elementOne`-`elementTwo`-`elementThree`

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    ^[a-z][a-zA-Z0-9]*(-[a-z][a-zA-Z0-9]*)*$
    ```
  </Tab>

  <Tab title="PascalCase">
    **Example**: `ElementOne`-`ElementTwo`-`ElementThree`

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    ^[A-Z][a-zA-Z0-9]*(-[A-Z][a-zA-Z0-9]*)*$
    ```
  </Tab>
</Tabs>

<Note>
  If you want a specific length limit (e.g., max 50 characters), you can add a lookahead at the start of the regex:

  ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  ^(?=.{1,50}$) # + rest of the regex
  ```

  You can use online regex testers like [regex101](https://regex101.com/) to validate and test these expressions.
</Note>


# CI/CD
Source: https://docs.kosli.com/integrations/ci_cd

Use Kosli in CI Systems like GitHub Actions, GitLab CI, and more.

This section provides how-to guides showing you how to use Kosli to report changes from
different CI systems.

<Note>
  Note that **all** CLI command flags can be set as environment variables by adding the the `KOSLI_` prefix and capitalizing them.
</Note>

## Defaulted Kosli command flags from CI variables

The following flags are **defaulted** (which means you don't need to provide the flags, they'll be automatically set to values listed below) as follows in the CI systems below:

<Tabs>
  <Tab title="GitHub" icon="github">
    View defaulted Kosli command flags in Github Actions.

    | Flag            | Default                                                                |
    | :-------------- | :--------------------------------------------------------------------- |
    | --build-url     | `<GITHUB_SERVER_URL>/<GITHUB_REPOSITORY>/actions/runs/<GITHUB_RUN_ID>` |
    | --commit-url    | `<GITHUB_SERVER_URL>/<GITHUB_REPOSITORY>/commit/<GITHUB_SHA>`          |
    | --commit        | `<GITHUB_SHA>`                                                         |
    | --git-commit    | `<GITHUB_SHA>`                                                         |
    | --repository    | `<GITHUB_REPOSITORY>`                                                  |
    | --repo-id       | `<GITHUB_REPOSITORY_ID>`                                               |
    | --repo-url      | `<GITHUB_SERVER_URL>/<GITHUB_REPOSITORY>`                              |
    | --repo-provider | `github`                                                               |
    | --github-org    | `<GITHUB_REPOSITORY_OWNER>`                                            |

    Where `<PLACEHOLDERS>` are Github Actions predefined variables. See [here](https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables) for more details.

    ## Use Kosli in Github Actions

    To use Kosli in [Github Actions](https://docs.github.com/en/actions) workflows, you can use the [`setup-kosli-cli` GitHub Action](/github-action-reference/setup_cli_action) to install the CLI on your Github Actions Runner.
    Then, you can use all the [CLI commands](/client_reference) in your workflows. See the GitHub Action reference for its inputs, outputs, and version-pinning options.

    ### GitHub Secrets

    Keep in mind that secrets in Github actions are not automatically exported as environment variables. You need to add required secrets to your GITHUB environment explicitly. E.g. to make kosli\_api\_token secret available for all cli commands as an environment variable use following:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    env:
      KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
    ```

    ### Example

    Here is an example Github Actions workflow snippet using `kosli-dev/setup-cli-action` running `kosli create flow` command:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    jobs:
      example:
        runs-on: ubuntu-latest
        env:
          KOSLI_API_TOKEN: ${{ secrets.MY_KOSLI_API_TOKEN }}
          KOSLI_ORG: my-org
        steps:
          - name: setup kosli
            uses: kosli-dev/setup-cli-action@v5
          - name: create flow
            run: kosli create flow my-flow --template pull-request,artifact,test
    ```

    For a complete example of a Github workflow using Kosli, please check the Kosli CLI's [own workflow](https://github.com/kosli-dev/cli/blob/main/.github/workflows/docker.yml).
  </Tab>

  <Tab title="GitLab" icon="gitlab">
    | Flag            | Default                                     |
    | :-------------- | :------------------------------------------ |
    | --build-url     | `<CI_JOB_URL>`                              |
    | --commit-url    | `<CI_PROJECT_URL>/-/commit/<CI_COMMIT_SHA>` |
    | --commit        | `<CI_COMMIT_SHA>`                           |
    | --git-commit    | `<CI_COMMIT_SHA>`                           |
    | --repository    | `<CI_PROJECT_NAME>`                         |
    | --repo-id       | `<CI_PROJECT_ID>`                           |
    | --repo-url      | `<CI_PROJECT_URL>`                          |
    | --repo-provider | `gitlab`                                    |
    | --gitlab-org    | `<CI_PROJECT_NAMESPACE>`                    |

    Where `<PLACEHOLDERS>` are GitLab predefined variables. See [here](https://docs.gitlab.com/ee/ci/variables/predefined_variables.html) for more details.

    ## Use Kosli in Gitlab pipelines

    For a complete example of a Gitlab pipeline using Kosli, please check [this cyber-dojo pipeline](https://gitlab.com/cyber-dojo/creator/-/blob/main/.gitlab/workflows/main.yml).

    ### CI runner image (Alpine)

    The Kosli CLI repository ships an Alpine-based [`Dockerfile.alpine`](https://github.com/kosli-dev/cli/blob/main/Dockerfile.alpine) intended for use as a CI runner image. Unlike the default `ghcr.io/kosli-dev/cli` image (which has the `kosli` binary as its entrypoint), the Alpine variant has no entrypoint and bundles `git`, `curl`, and `ca-certificates` alongside the CLI — so it can be used as a general-purpose job image where you also need to clone repos, hit HTTP APIs, or run other shell tooling next to `kosli`.

    Build and push it to your own registry, pinning the CLI version you want:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    # Clone or copy Dockerfile.alpine from https://github.com/kosli-dev/cli
    docker build \
      --build-arg KOSLI_VERSION=2.28.0 \
      -f Dockerfile.alpine \
      -t registry.example.com/ci/kosli-runner:2.28.0 .
    docker push registry.example.com/ci/kosli-runner:2.28.0
    ```

    Then use it as the job image in `.gitlab-ci.yml`:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    variables:
      KOSLI_ORG: my-org
      KOSLI_HOST: https://app.kosli.com

    attest:
      image: registry.example.com/ci/kosli-runner:2.28.0
      script:
        - kosli version
        - kosli attest generic
            --flow my-flow
            --trail "$CI_COMMIT_SHA"
            --name build
            --compliant=true
      # KOSLI_API_TOKEN should be set as a masked GitLab CI/CD variable
    ```

    The image runs as the non-root `kosli` user with `/workspace` as the working directory. `KOSLI_ORG` and `KOSLI_HOST` are exposed as environment variables so they can be overridden in your CI configuration; `KOSLI_API_TOKEN` should be supplied via a masked CI variable rather than baked into the image.
  </Tab>

  <Tab title="Azure DevOps">
    View defaulted Kosli command flags in Azure DevOps.

    | Flag            | Default                                                                                                 |
    | :-------------- | :------------------------------------------------------------------------------------------------------ |
    | --build-url     | `<System.CollectionUri>/<System.TeamProject>/_build/results?buildId=<Build.BuildId>`                    |
    | --commit-url    | `<System.CollectionUri>/<System.TeamProject>/_git/<Build.Repository.Name>/commit/<Build.SourceVersion>` |
    | --commit        | `<Build.SourceVersion>`                                                                                 |
    | --git-commit    | `<Build.SourceVersion>`                                                                                 |
    | --repository    | `<Build.Repository.Name>`                                                                               |
    | --repo-id       | `<Build.Repository.Id>`                                                                                 |
    | --repo-url      | `<Build.Repository.Uri>`                                                                                |
    | --repo-provider | `azure-devops`                                                                                          |
    | --project       | `<System.TeamProject>`                                                                                  |
    | --azure-org-url | `<System.CollectionUri>`                                                                                |

    Where `<PLACEHOLDERS>` are Azure DevOps predefined variables. See [here](https://learn.microsoft.com/en-us/azure/devops/pipelines/build/variables?view=azure-devops\&tabs=yaml) for more details.
  </Tab>

  <Tab title="Bitbucket Cloud">
    View defaulted Kosli command flags in Bitbucket Cloud.

    | Flag                  | Default                                                                                                                     |
    | :-------------------- | :-------------------------------------------------------------------------------------------------------------------------- |
    | --build-url           | `https://bitbucket.org/<BITBUCKET_WORKSPACE>/<BITBUCKET_REPO_SLUG>/addon/pipelines/home#!/results/<BITBUCKET_BUILD_NUMBER>` |
    | --commit-url          | `https://bitbucket.org/<BITBUCKET_WORKSPACE>/<BITBUCKET_REPO_SLUG>/commits/<BITBUCKET_COMMIT>`                              |
    | --commit              | `<BITBUCKET_COMMIT>`                                                                                                        |
    | --git-commit          | `<BITBUCKET_COMMIT>`                                                                                                        |
    | --repository          | `<BITBUCKET_REPO_SLUG>`                                                                                                     |
    | --repo-id             | `<BITBUCKET_REPO_UUID>`                                                                                                     |
    | --repo-url            | `<BITBUCKET_GIT_HTTP_ORIGIN>`                                                                                               |
    | --repo-provider       | `bitbucket`                                                                                                                 |
    | --bitbucket-workspace | `<BITBUCKET_WORKSPACE>`                                                                                                     |

    Where `<PLACEHOLDERS>` are Bitbucket Cloud predefined variables. See [here](https://support.atlassian.com/bitbucket-cloud/docs/variables-in-pipelines/) for more details.
  </Tab>

  <Tab title="AWS CodeBuild">
    View defaulted Kosli command flags in AWS CodeBuild.

    | Flag         | Default                                                                     |
    | :----------- | :-------------------------------------------------------------------------- |
    | --build-url  | `<CODEBUILD_BUILD_URL>`                                                     |
    | --commit-url | `<CODEBUILD_SOURCE_REPO_URL>/commit(s)/<CODEBUILD_RESOLVED_SOURCE_VERSION>` |
    | --commit     | `<CODEBUILD_RESOLVED_SOURCE_VERSION>`                                       |
    | --git-commit | `<CODEBUILD_RESOLVED_SOURCE_VERSION>`                                       |
    | --repo-url   | `<CODEBUILD_SOURCE_REPO_URL>`                                               |

    Where `<PLACEHOLDERS>` are AWS CodeBuild predefined variables. See [here](https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-env-vars.html) for more details.
  </Tab>

  <Tab title="CircleCI">
    View defaulted Kosli command flags in CircleCI.

    | Flag         | Default                                                                   |
    | :----------- | :------------------------------------------------------------------------ |
    | --build-url  | `<CIRCLE_BUILD_URL>`                                                      |
    | --commit-url | `<CIRCLE_REPOSITORY_URL>(converted to https url)/commit(s)/<CIRCLE_SHA1>` |
    | --commit     | `<CIRCLE_SHA1>`                                                           |
    | --git-commit | `<CIRCLE_SHA1>`                                                           |
    | --repository | `<CIRCLE_PROJECT_REPONAME>`                                               |
    | --repo-url   | `<CIRCLE_REPOSITORY_URL>`                                                 |

    Where `<PLACEHOLDERS>` are CircleCI predefined variables. See [here](https://circleci.com/docs/env-vars/#built-in-environment-variables) for more details.
  </Tab>

  <Tab title="Teamcity">
    View defaulted Kosli command flags in Teamcity.

    | Flag         | Default              |
    | :----------- | :------------------- |
    | --git-commit | `<BUILD_VCS_NUMBER>` |

    Where `<PLACEHOLDERS>` are Teamcity predefined variables. See [here](https://www.jetbrains.com/help/teamcity/predefined-build-parameters.html) for more details.
  </Tab>
</Tabs>


# Kosli Actions
Source: https://docs.kosli.com/integrations/kosli_actions

Automate if-this-then-that workflows with Kosli Actions.

<Note>
  You need the Admin or Member role to create, update, and delete Actions.

  Learn more about roles in Kosli in [Roles in Kosli](/administration/managing_users/roles_in_kosli/).
</Note>

Actions enable you to automate the execution of if-this-do-that workflows based on Kosli events. You can configure actions to either receive a Slack notification or a JSON payload on a custom webhook when certain Kosli events happen.

You can configure actions to be triggered by one or more of the following events occurring in one or more environments:

* When a new artifact starts execution in an environment.
* When an artifact ceases execution in an environment.
* When instances of an artifact are scaled up or down.
* When an artifact is added to the allow-list in an environment.
* When an environment changes state from <Badge>Compliant</Badge> to <Badge>Non-Compliant</Badge>.
* When an environment changes state from <Badge>Non-Compliant</Badge> to <Badge>Compliant</Badge>.

## Slack Notifications

To receive Kosli notifications in Slack, you have two options. You can either use the Kosli Slack App or set up Slack Incoming Webhooks. Both approaches allow you to configure Kosli notifications in Slack, offering flexibility based on your preferences.

<Card title="Kosli Slack App (recommended)" icon="slack">
  Subscribe to Kosli notifications using the [Kosli Slack App](/integrations/slack/). This method is recommended for a seamless integration.
  Use the app to create notification settings by running the `/kosli subscribe` slash command.
</Card>

<Card title="Slack Incoming Webhooks" icon="webhook">
  * Create a [Slack incoming webhook](https://api.slack.com/messaging/webhooks#create_a_webhook).
  * Use this webhook to [create a notification settings in the Kosli UI](/integrations/kosli_actions/#manage-actions-in-the-ui).
</Card>

## Custom Webhook Notifications

Custom webhook notifications empower you to implement automation workflows for "if-this-then-that" scenarios. Whenever an event that matches your specified notification settings occurs, a JSON payload, as outlined below, is transmitted to your designated custom webhook:

```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
{
    "version": "1.0",
    "timestamp": "1692616493",
    "org": "cyber-dojo",
    "environment": "aws-prod",
    "event_type": "ARTIFACT_STARTED",
    "description": "1 instance started running (from 0 to 1)",
    "snapshot":  {
           "index": "1035",
           "status": "compliant",
           "html_url": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/1035",
           "api_url": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/1035"
     },
    "artifact": {
        "name": "runner",
        "fingerprint": "719defb995c86ad7c406ad74258fe98b9ebd71dfa80cd786870c967cb6c1f08d",
        "provenance": {
            "flow": "runner",
            "status": "compliant",
            "commit": "1ac157003dd6fb9ec764daa47726b7bfed65c312",
            "commit_url": "https://github.com/cyber-dojo/runner/commit/1ac157003dd6fb9ec764daa47726b7bfed65c312",
            "html_url": "https://app.kosli.com/cyber-dojo/runner/719defb995c86ad7c406ad74258fe98b9ebd71dfa80cd786870c967cb6c1f08d",
            "api_url": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/runner/fingerprint/719defb995c86ad7c406ad74258fe98b9ebd71dfa80cd786870c967cb6c1f08d",
            "build_url": "https://github.com/cyber-dojo/runner/actions/runs/5891969166"
        }
    }
}
```

## Email

Provide a comma-separated list of recipient email addresses. Notifications are sent from `noreply@kosli.com`.

# Manage Actions in the UI

You can manage Actions for your organization in the Kosli UI from the `Actions` section in the left navigation menu. The Actions sections enables you to:

* **Create Notifications:** Create a new notifications settings.
* **Delete Notifications:** Remove existing notification settings that are no longer needed.
* **Update Notifications:** Modify notification settings as needed.


# LaunchDarkly
Source: https://docs.kosli.com/integrations/launchdarkly

LaunchDarkly feature flag changes can be tracked in Kosli trails.

LaunchDarkly feature flag changes can be tracked in [Kosli trails](/getting_started/trails).

## Setting up in Kosli

To set up the integration, navigate to the LaunchDarkly integration page of your org in the [Kosli app](https://app.kosli.com/).

<Frame>
  <img alt="Descriptive alt text" />
</Frame>

After switching on the integration, you will be provided with a webhook and a secret.

## Setting up in LaunchDarkly

You're now just a few steps away from connecting LaunchDarkly to Kosli.
In [LaunchDarkly](https://app.launchdarkly.com/):

* Navigate to the "Integrations" tab
* Create a new webhook integration
* Enter the webhook url and secret in the relevant fields
* Add policy statements for flags and environments for which you'd like to send information Kosli. By leaving these policy statements blank, all flag changes in all environments will report back to Kosli.
* Save the settings

## Testing the integration

To make sure the integration is configured properly, switch a feature flag on or off.
The first time a flag is changed in a LaunchDarkly environment, a [Flow](/getting_started/flows) will be created in Kosli titled `launch-darkly-<your_environment_name>`, and inside this flow a trail will be created named after the name of your feature flag.
All changes to this flag will be found in the trail.
Subsequently, any change to a feature flag in this environment will be tracked in the appropriate trail.


# MCP server
Source: https://docs.kosli.com/integrations/mcp_server

Connect AI assistants such as Claude Code and Claude Desktop to the Kosli API using the Model Context Protocol.

The Kosli MCP server is a [Model Context Protocol](https://modelcontextprotocol.io) server that exposes the Kosli API to AI assistants. Once it is connected, you can ask questions like *"which environments are non-compliant, and why?"* and the assistant calls the relevant Kosli endpoints to answer.

It is published from [`kosli-dev/mcp-server`](https://github.com/kosli-dev/mcp-server) and distributed as an npm package (`@kosli/mcp-server`) and as a `.mcpb` bundle for Claude Desktop.

<Warning>
  The Kosli MCP server is in beta. Tool names, parameters, and behavior may change between releases. Pin a version if you need stability: `npx -y @kosli/mcp-server@0.5.0`.
</Warning>

<Note>
  This server reads the data in your Kosli organization. To let an AI assistant search this documentation instead, see [AI access to these docs](/understand_kosli/ai_docs_access). The two are complementary, and you can connect both.
</Note>

## How it works

Rather than ship one tool per Kosli endpoint, the server generates a catalog of actions from Kosli's OpenAPI spec and exposes three generic tools:

| Tool                   | Purpose                                                                                  |
| ---------------------- | ---------------------------------------------------------------------------------------- |
| `search_actions`       | Fuzzy-search the catalog for relevant actions by natural-language query.                 |
| `execute_read_action`  | Invoke any `GET` action by ID. Auto-allowed in MCP clients.                              |
| `execute_write_action` | Invoke any `POST`, `PUT`, `PATCH`, or `DELETE` action by ID. Gated behind user approval. |

These are the tool names your client shows as the assistant works, and the name in the prompt when it asks you to approve a write.

<Warning>
  `execute_write_action` creates, modifies, and deletes real resources in your Kosli organization. MCP clients gate these calls behind an approval prompt, and that prompt is the only checkpoint before the call is made. An assistant may choose the wrong action, or the right action with the wrong parameters, so read the action ID and parameters before approving. Treat deletions and anything touching service accounts or API keys with particular care.
</Warning>

## Prerequisites

* Node.js v22 or higher, for the `npx`-based install methods. You do not need it for the `.mcpb` bundle, because Claude Desktop ships its own Node runtime.
* A Kosli API key. Use a [personal API key](/user/personal_api_keys) when you run the server on your own machine, or a [service account key](/administration/authentication/service_accounts) for automation.
* An MCP-capable client, such as Claude Code or Claude Desktop.

## Install

<Tabs>
  <Tab title="Claude Code">
    Run this from your project directory, or add `--scope user` to install it globally:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    claude mcp add kosli \
      -e KOSLI_API_TOKEN=your-token \
      -e KOSLI_ORG=your-org \
      -- npx -y @kosli/mcp-server
    ```
  </Tab>

  <Tab title="Claude Desktop (.mcpb)">
    Download the latest `.mcpb` file from the [releases page](https://github.com/kosli-dev/mcp-server/releases) and drag it into Claude Desktop, or double-click it to install. Claude Desktop prompts you for your API key and organization, and stores the secrets in your operating system keychain.

    This is the recommended method for Claude Desktop.

    <Note>
      Extensions installed from a file show an "unverified by Anthropic" warning and do not auto-update, so you need to download and reinstall new versions manually. Both limitations go away once the extension is listed in Anthropic's [Connectors Directory](https://claude.com/docs/connectors/building/submission).
    </Note>
  </Tab>

  <Tab title="Claude Desktop (manual)">
    Add the following to `claude_desktop_config.json`, which you can open from **Settings → Developer → Edit Config**:

    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    {
      "mcpServers": {
        "kosli": {
          "command": "npx",
          "args": ["-y", "@kosli/mcp-server"],
          "env": {
            "KOSLI_API_TOKEN": "your-token",
            "KOSLI_ORG": "your-org"
          }
        }
      }
    }
    ```

    This method auto-updates through `npx` on each restart, but stores your API key in plain text.
  </Tab>

  <Tab title="Other MCP clients">
    The server communicates over stdio. Point any MCP-capable client at the package with `npx -y @kosli/mcp-server` and set the environment variables below.
  </Tab>
</Tabs>

## Configuration

The server reads its configuration from environment variables.

| Variable          | Required | Default                 | Notes                                                                             |
| ----------------- | -------- | ----------------------- | --------------------------------------------------------------------------------- |
| `KOSLI_API_TOKEN` | yes      | -                       | `KOSLI_API_KEY` is accepted as a fallback.                                        |
| `KOSLI_ORG`       | yes      | -                       | Default org. Used as the `org` path parameter when an action does not supply one. |
| `KOSLI_BASE_URL`  | no       | `https://app.kosli.com` | Use `https://app.us.kosli.com` for US, or your own single-tenant endpoint.        |

## Example prompts

These prompts only read data, so they run without an approval step. Replace the environment, flow, and trail names with your own.

### Environments and compliance

* "Which of my environments are non-compliant, and why?"
* "What is running in `prod-aws` right now?"
* "Has anything changed in `prod-aws` since yesterday?"

The assistant answers these from [environment snapshots](/getting_started/environments), so it can report both the current state and the reasons an environment is not compliant.

### Audit and evidence

* "List every deployment to `prod-aws` in the last 30 days."
* "What attestations are on trail `release-456` in flow `my-release`?"
* "Which artifacts running in `prod-aws` have no security scan attestation?"

The last prompt takes several tool calls, because the assistant has to list what is running and then check the [attestations](/getting_started/attestations) on each artifact. Expect it to be slower than a single lookup, and check the artifact list it worked from before relying on the answer.

## Limitations

* The action catalog is generated from a snapshot of the OpenAPI spec. New endpoints become available when the catalog is regenerated and a new version of the package is published.
* Ambiguous questions may take several `search_actions` calls before the assistant settles on the right action.
* Responses are whatever the Kosli API returns. Large responses consume a lot of context, so ask for specific fields when you can.

## Feedback

The server is in beta and we want to hear how it works for you. Email [support@kosli.com](mailto:support@kosli.com) or open an issue in [`kosli-dev/mcp-server`](https://github.com/kosli-dev/mcp-server/issues).


# Slack
Source: https://docs.kosli.com/integrations/slack

Integrate Kosli with Slack using the Kosli Slack App to receive notifications and query your environments and artifacts directly from Slack.

Allows you to configure and receive notifications about changes in your environments and query Kosli about your environments and artifacts without leaving Slack window.

<Steps>
  <Step title="Installation">
    Visit [https://slack.kosli.com](https://slack.kosli.com) to add Kosli Slack App to your Slack workspace.
  </Step>

  <Step title="Usage">
    Now that Kosli Slack App is installed you can start using all `/kosli` commands in any channel.

    At any time you can run `/kosli help` to see which commands are available.

    The next step is connecting your Slack user with your Kosli user, use the command below to do that:

    ```
    /kosli login
    ```

    After that you may want to set up default Kosli organization, so you don't have to provide it every time you want to run `/kosli` commands from slack.

    E.g. if the organization name is **my-org**:

    ```
    /kosli config org my-org
    ```

    In case of commands referring to snapshots you can specify snapshot(s) you're interested in multiple ways:

    * `environmentName~N` *N'th behind the latest snapshot*
    * `environmentName#N` *snapshot number N*
    * `environmentName@{YYYY-MM-DDTHH:MM:SS}` *snapshot at specific moment in time in UTC*
    * `environmentName` *the latest snapshot*
  </Step>

  <Step title="Example: Search for an artifact">
    <Card title="Example">
      Here is an example of *search* command and the response:
      `/kosli search edb1a262`
    </Card>
  </Step>
</Steps>


# Sonar
Source: https://docs.kosli.com/integrations/sonar

The results of SonarQube Server and SonarQube Cloud scans can be tracked in Kosli trails. This integration involves setting up a Sonar webhook in Kosli and a corresponding webhook in SonarQube.

The results of SonarQube Server and SonarQube Cloud scans can be tracked in [Kosli trails](/getting_started/trails).
This integration involves setting up a Sonar webhook in Kosli and a corresponding webhook in SonarQube. When you run a scan of your SonarQube project, the webhook is triggered and the results of the scan are sent to Kosli.
Some parameters must be passed to the Sonar scanner when it is run (e.g. the name of the Flow corresponding to the project, and the name of the trail the results should be attested to); these are sent with the scan results, and allow Kosli to determine the compliance status of the results and attest them to the correct trail/artifact.

## Setting up in Kosli

To set up the integration, navigate to the Sonar integration page for your org in the [Kosli app](https://app.kosli.com/).

After switching on the integration, you will be provided with a webhook and a secret.

#### Configuring the flow name

By default, Kosli will use the key of your SonarQube project as the flow name for the sonar attestation. You can configure this flow name in the "Flow Name Options" section on the integration page, by choosing either the project name or key as the base of the flow name, and then optionally adding a prefix and/or suffix.

Note that if you set the flow name by sending a parameter to the Sonar Scanner (see [Scanner parameters](#scanner-parameters) below), this configuration will be overridden.

## Setting up Sonar Webhooks

You're now just a few steps away from connecting SonarQube to Kosli.

Both SonarQube Server and SonarQube Cloud provide two types of webhooks: global (which are triggered when any project in your organization is scanned) and project-specific (which are triggered by a scan for that project only). Kosli supports both types of webhooks.

In [SonarQube Cloud](https://sonarcloud.io/) or [SonarQube Server](https://sonarqube.org):

### To create a global webhook:

* In SonarQube Cloud: Go to your Organization, then Administration > Webhooks
* In SonarQube Server: Go to Administration > Configuration > Webhooks
* Create a new Webhook
* Add the Kosli webhook URL and secret provided
* Click Create

<Frame>
  <img alt="Descriptive alt text" />
</Frame>

<Frame>
  <img alt="Descriptive alt text" />
</Frame>

### To create a project-specific webhook:

* Go to the project you want to create a webhook for
* Click on Administration (SonarQube Cloud) or Project Settings (SonarQube Server) and go to Webhooks in the dropdown menu
* Create a new Webhook
* Add the Kosli webhook URL and secret provided
* Click Create

<Frame>
  <img alt="Descriptive alt text" />
</Frame>

<Frame>
  <img alt="Descriptive alt text" />
</Frame>

## Setting up the SonarScanner

In order for Kosli to know where the scan results should be attested, certain parameters can be passed to the SonarScanner. Note that parameters cannot be passed with SonarQube Cloud's Automatic Analysis - in this case, Kosli determines the relevant Flow and Trail as described below.

These parameters can be passed to the scanner in three ways:

* As part of the sonar-project.properties file used in CI analysis
* As arguments to the scanner in your CI pipeline's YML file

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    - name: SonarQube Scan
        uses: SonarSource/sonarqube-scan-action@master
        with:
          args: >
            -Dsonar.analysis.kosli_flow=<YourFlowName>
            -Dsonar.analysis.kosli_trail=<YourTrailName>
```

* As arguments to the CLI scanner

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
$ sonar-scanner \
  -Dsonar.analysis.kosli_flow=<YourFlowName> \
  -Dsonar.analysis.kosli_trail=<YourTrailName>
```

### Scanner parameters:

* `sonar.analysis.kosli_flow=<YourFlowName>`
  * The name of the Flow relevant to your project. If a Flow does not already exist with the given name, it is created. If no Flow name is provided, it is determined using the chosen Flow name configuration (see [Configuring the flow name](#configuring-the-flow-name) above), with any invalid symbols replaced by '-'.
* `sonar.analysis.kosli_trail=<YourTrailName>`
  * The name of the Trail to attest the scan results. If a Trail does not already exist with the given name it is created. If no Trail name is provided, the revision ID of the SonarQube project (typically defaulted to the Git SHA) is used as the name.
* `sonar.analysis.kosli_attestation=<YourAttestationName>`
  * The name you want to give to the attestation. If not provided, a default name "sonar" is used. If using dot-notation (of the form `<YourTargetArtifact.YourAttestationName>`), either the artifact fingerprint or git commit is also required (see below).
* `sonar.analysis.kosli_git_commit=<GitCommitSHA>`
  * The git commit for the attestation. If not provided the revision ID of the SonarQube project is used (provided it has the correct format for a git SHA).
* `sonar.analysis.kosli_artifact_fingerprint=<YourArtifactFingerprint>`
  * The fingerprint of the artifact you want the attestation to be attached to. Requires that the artifact has already been reported to Kosli.
* `sonar.analysis.kosli_flow_description=<DescriptionOfYourKosliFlow>`
  * The description for the Kosli Flow being created by this webhook. This will not be used if attesting to an already-existing Flow (i.e. will not change any existing descriptions).
* `sonar.analysis.kosli_trail_description=<DescriptionOfYourKosliTrail>`
  * The description for the Kosli Trail being created by this webhook. This will not be used if attesting to an already-existing Trail (i.e. will not change any existing descriptions).

## Testing the integration

To test the webhook once configured, simply scan a project in SonarQube. If successful, the results of the scan will be attested to the relevant Flow and Trail (and artifact, if applicable) as a sonar attestation.
If the webhook fails, check that you have passed the parameters to the scanner correctly, and that the trail name, attestation name and artifact fingerprint are valid.

## Live Example in CI system

View an example of a sonar attestation via webhook in Github.

In [this YAML file](https://app.kosli.com/api/v2/livedocs/cyber-dojo/yaml?ci=github\&command=-Dsonar.analysis.kosli_flow), which created [this Kosli event](https://app.kosli.com/api/v2/livedocs/cyber-dojo/event?ci=github\&command=-Dsonar.analysis.kosli_flow).

## Alternatives:

If you'd rather not use webhooks, or they don't quite fit your use-case, we also have a [CLI command](/client_reference/kosli_attest_sonar) for attesting Sonar scan results to Kosli.


# Kosli Learning Labs
Source: https://docs.kosli.com/labs/index

A hands-on five-lab series taking you from your first Kosli account to full supply chain compliance enforcement.

These labs provide a progressive, practical introduction to Kosli's core features. You'll learn how to track your software delivery process from build through deployment, establish compliance requirements, and maintain complete visibility into your software supply chain.

Each lab builds on the previous one — complete them in order.

<Info>
  Want something shorter first? [Try Kosli locally](/tutorials/try_kosli_locally) is a 10-minute Docker-based demo that requires no GitHub account or CI pipeline.
</Info>

<Info>
  **Prerequisites**: A GitHub account, basic familiarity with Git and CI/CD concepts. No prior Kosli experience required.
</Info>

<CardGroup>
  <Card title="Lab 1: Get Ready" icon="rocket" href="/labs/lab-01-get-ready">
    Fork the sample repository and verify the CI/CD pipeline runs successfully.
  </Card>

  <Card title="Lab 2: Flows and Trails" icon="code-branch" href="/labs/lab-02-flows-and-trails">
    Install the Kosli CLI, create Flows and Trails, and integrate them into your GitHub Actions workflow.
  </Card>

  <Card title="Lab 3: Build Controls" icon="shield-check" href="/labs/lab-03-build-controls">
    Attest artifacts, attach JUnit test results, and generate and attest a Software Bill of Materials.
  </Card>

  <Card title="Lab 4: Release Controls" icon="lock" href="/labs/lab-04-release-controls">
    Define compliance requirements with Flow Templates and gate deployments with `kosli assert artifact`.
  </Card>

  <Card title="Lab 5: Runtime Controls" icon="server" href="/labs/lab-05-runtime-controls">
    Create environments, snapshot what's running in production, and enforce compliance policies.
  </Card>
</CardGroup>

<Note>
  The labs use a sample Java application with a pre-built GitHub Actions pipeline. You'll progressively add Kosli integration to that pipeline across Labs 2–5.
</Note>

The standalone lab repository is also available at [github.com/kosli-dev/labs](https://github.com/kosli-dev/labs).


# Lab 1: Get Ready
Source: https://docs.kosli.com/labs/lab-01-get-ready

Fork the sample repository, verify the CI/CD pipeline, and install the Kosli CLI.

## Learning goals

* Create a copy of the sample application repository
* Verify the CI/CD pipeline runs successfully
* Install the Kosli CLI and create an API key
* Understand the basic structure of the application and its deployment process

## Introduction

Before diving into Kosli's features, you need to set up your account and verify that your sample application builds and deploys correctly.

This lab uses a simple Java application with a complete CI/CD pipeline already configured in GitHub Actions. The pipeline builds the application, creates a Docker image, runs tests, and deploys it. In subsequent labs, you'll integrate Kosli to track all these activities.

## Exercise

<Steps>
  <Step title="Fork the sample repository">
    * Navigate to [github.com/kosli-dev/labs](https://github.com/kosli-dev/labs)
    * Click the **Use this template** button in the top-right corner
    * Select **Create a new repository**
    * Set your personal GitHub account as the **Owner** and name the repository `labs`
    * Click **Create repository from template**

    <Tip>
      From now on, "your repository" refers to your copy of the labs repository at `https://github.com/YOUR-GITHUB-USERNAME/labs`.
    </Tip>
  </Step>

  <Step title="Enable GitHub Actions">
    1. Go to your repository on GitHub
    2. Click the **Actions** tab
    3. If prompted, click **I understand my workflows, go ahead and enable them**
    4. If the workflow doesn't start automatically, trigger it manually:
       * Click **Main workflow** in the left sidebar
       * Click **Run workflow**, select `main`, and click **Run workflow**
  </Step>

  <Step title="Verify the pipeline">
    In the **Actions** tab, click the most recent workflow run and observe the jobs:

    | Job              | What it does                                |
    | ---------------- | ------------------------------------------- |
    | Build            | Compiles the Java application using Gradle  |
    | Linting          | Checks code quality (warnings are expected) |
    | Docker-image     | Builds and pushes a Docker container image  |
    | Security-scan    | Scans the Docker image for vulnerabilities  |
    | Component-test   | Runs integration tests                      |
    | Performance-test | Runs basic performance checks               |
    | Deploy           | Starts and stops the application container  |

    Wait for all jobs to show green checkmarks.

    <Frame>
      <img alt="GitHub Actions pipeline showing all jobs completing successfully" />
    </Frame>

    <Tip>
      The pipeline may take 3–6 minutes on the first run. GitHub Actions provides free minutes for public repositories.
    </Tip>

    <Accordion title="Common issues">
      * **Docker-image job fails with permission error**: Make sure your repository has package write permissions enabled.
      * **Linting shows warnings**: This is expected and won't fail the build (`DISABLE_ERRORS` is set to `true`).
    </Accordion>
  </Step>

  <Step title="Install the Kosli CLI">
    Run the one-line install script:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    curl -fL https://raw.githubusercontent.com/kosli-dev/cli/refs/heads/main/install-cli.sh | sh

    # Verify installation
    kosli version
    ```

    <Tip>
      If this method fails, see [Install Kosli CLI](/getting_started/install) for alternative installation options (Homebrew, APT, Docker, etc.).
    </Tip>
  </Step>

  <Step title="Create a Kosli API key">
    * Log in to [app.kosli.com/settings/profile](https://app.kosli.com/settings/profile)
    * Navigate to the **API Keys** section
    * Click **Add API Key**, give it a name (e.g., "CLI Access"), and copy the key immediately — it won't be shown again

    Configure it for local use:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export KOSLI_API_TOKEN="your-api-key-here"
    export KOSLI_ORG="your-gh-username"
    ```

    Verify the CLI can reach Kosli:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list flows
    ```

    You should see "No flows were found" — which confirms authentication is working.

    <Warning>
      Never commit API keys to your repository. You'll add this key to GitHub Secrets in Lab 2.
    </Warning>

    See [Authenticating to Kosli](/getting_started/authenticating_to_kosli) for more on API key management.
  </Step>

  <Step title="Explore the workflow file">
    In your repository, navigate to `.github/workflows/full-pipeline.yaml` and review the structure:

    * Notice how it triggers on every push
    * Observe the environment variables at the top
    * See how artifacts are shared between jobs using `upload-artifact` and `download-artifact`
    * Note the dependencies between jobs (e.g., Docker-image requires Build to complete first)

    In later labs, you'll add Kosli integration to this file.
  </Step>

  <Step title="View the published Docker image">
    1. Go to your GitHub profile page
    2. Click the **Packages** tab
    3. You should see the `labs` package
    4. Click it to view the Docker image details — note the image tag (`latest`) and SHA digest

    <Tip>
      The Docker image is automatically published to GitHub Container Registry (`ghcr.io`) by the pipeline.
    </Tip>
  </Step>
</Steps>

## Verification checklist

Before moving to the next lab, confirm:

* [ ] Copy of the labs repository under your GitHub account
* [ ] GitHub Actions completed all jobs successfully
* [ ] Docker image published to your GitHub Container Registry
* [ ] Kosli CLI installed (`kosli version` works)
* [ ] API key created and `kosli list flows` returns successfully
* [ ] You understand the basic pipeline structure

## Next steps

Continue to [Lab 2: Flows and Trails](/labs/lab-02-flows-and-trails) to create your first Flow and Trail and integrate them into your pipeline.


# Lab 2: Flows and Trails
Source: https://docs.kosli.com/labs/lab-02-flows-and-trails

Create Flows and Trails using the Kosli CLI, and integrate them into your GitHub Actions workflow.

<Info>
  **Prerequisites**: Complete [Lab 1: Get Ready](/labs/lab-01-get-ready) before starting this lab. You should have the Kosli CLI installed and an API key configured.
</Info>

## Learning goals

* Understand the concepts of Flows and Trails
* Create your first Flow using the CLI
* Begin a Trail manually to track a process execution
* Integrate Flow and Trail creation into your CI/CD workflow

## Introduction

Kosli uses **Flows** and **Trails** to organize and track your software delivery processes:

* A **Flow** represents a repeatable business or software process (like your CI/CD pipeline). It defines what you want to track and what compliance requirements must be met.
* A **Trail** represents a single execution instance of that Flow. For example, each git commit creates a new Trail that tracks all activities for that specific change.

Think of a Flow as the template for your process, and Trails as individual instances that record what actually happened.

## Exercise

<Steps>
  <Step title="Create a Flow manually">
    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create flow labs-pipeline \
      --description "CI/CD pipeline for labs application" \
      --use-empty-template

    # Verify it was created
    kosli get flow labs-pipeline
    ```

    You should see output like:

    ```
    Name:                labs-pipeline
    Description:         CI/CD pipeline for labs application
    Visibility:          private
    Template:
                         version: 1
    Last Deployment At:  N/A
    Tags:                None
    ```

    Visit [app.kosli.com](https://app.kosli.com) and navigate to **Flows** to see your newly created Flow.

    <Tip>
      The `--use-empty-template` flag creates a Flow without compliance requirements. In Lab 4, you'll add a template with specific attestation requirements.
    </Tip>

    See [`kosli create flow`](/client_reference/kosli_create_flow) for full flag reference.
  </Step>

  <Step title="Begin a Trail manually">
    A Trail represents one execution of your process. Create one using your latest git commit SHA:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    # Run this inside your copy of the labs repository
    kosli begin trail $(git rev-parse HEAD) \
      --flow labs-pipeline \
      --description "Manual trail for testing"

    # Verify it was created
    kosli get trail $(git rev-parse HEAD) \
      --flow labs-pipeline
    ```

    <Warning>
      Make sure you run this inside your copy of the labs repository, not the original.
    </Warning>

    The Trail name is the git commit SHA, which uniquely identifies this execution and lets Kosli connect all activities (builds, tests, deployments) for that specific commit.

    <Tip>
      You can use any naming scheme for Trails (commit SHA, PR number, Jira ticket, etc.). Git commits are common because they're unique and tied to your source code.
    </Tip>

    <Frame>
      <img alt="Kosli web interface showing the first trail under labs-pipeline" />
    </Frame>

    See [`kosli begin trail`](/client_reference/kosli_begin_trail) for full flag reference.
  </Step>

  <Step title="Explore trail immutability">
    Everything in a Kosli trail is immutable — updates are append-only. This is critical for compliance: if data could be changed, it could be tampered with.

    Run `begin trail` again on the same commit with a slightly different description:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli begin trail $(git rev-parse HEAD) \
      --flow labs-pipeline \
      --description "Manual trail for testing."
    ```

    Now get the trail again:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get trail $(git rev-parse HEAD) \
      --flow labs-pipeline
    ```

    Notice the **Events** section shows both the original `trail started` event and a new `trail updated` event — the history is preserved, not overwritten.
  </Step>

  <Step title="Add Kosli secrets to GitHub">
    1. In your repository, go to **Settings → Secrets and variables → Actions**
    2. Click **New repository secret**, name it `KOSLI_API_TOKEN`, and paste your API key
    3. Click **Variables → New repository variable**, name it `KOSLI_ORG`, and enter your GitHub username

    <Warning>
      Never commit API keys to your repository. Always use GitHub Secrets.
    </Warning>
  </Step>

  <Step title="Update the GitHub Actions workflow">
    Open `.github/workflows/full-pipeline.yaml` and make the following changes:

    **1. Add global environment variables** at the top of the file:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    env:
      KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }}
      KOSLI_ORG: ${{ vars.KOSLI_ORG }}
      # ... other existing env vars ...
    ```

    **2. Add Kosli steps** just after the `actions/checkout` step:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
          - name: Clone down repository
            uses: actions/checkout@v7

          - name: Setup Kosli CLI
            uses: kosli-dev/setup-cli-action@v5
            with:
              version: 2.28.0

          - name: Create/Update Flow
            run: |
              kosli create flow ${APP_NAME}-pipeline \
                --description "CI/CD pipeline for ${APP_NAME} application" \
                --use-empty-template

          - name: Begin Trail
            run: |
              kosli begin trail ${GIT_COMMIT} \
                --flow ${APP_NAME}-pipeline \
                --description "Build ${BUILD_NUMBER}: ${GIT_BRANCH}"
    ```

    <Tip>
      The `kosli-dev/setup-cli-action` installs the CLI in CI. The global `env` variables authenticate all subsequent CLI calls automatically.
    </Tip>
  </Step>

  <Step title="Push and verify">
    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    git add .github/workflows/full-pipeline.yaml
    git commit -m "Add Kosli Flow and Trail steps"
    git push origin main
    ```

    In GitHub Actions, watch the workflow run and confirm the **Setup Kosli CLI**, **Create/Update Flow**, and **Begin Trail** steps complete successfully.

    Then visit [app.kosli.com](https://app.kosli.com) → your Flow → you should see a new Trail corresponding to your commit.
  </Step>
</Steps>

## Verification checklist

* [ ] `KOSLI_API_TOKEN` and `KOSLI_ORG` added to GitHub Secrets/Variables
* [ ] Flow created manually via CLI
* [ ] Trail created manually using a git commit SHA
* [ ] Workflow updated with Kosli steps and runs successfully
* [ ] Flow and Trails visible in the Kosli web interface

<Note>
  If anything didn't go to plan, refer to the reference solution at `pipelines/02-complete.yaml` in the [labs repository](https://github.com/kosli-dev/labs).
</Note>

## Next steps

Continue to [Lab 3: Build Controls](/labs/lab-03-build-controls) to attest artifacts and attach evidence to your Trails.

**Further reading:**

* [Flows](/getting_started/flows)
* [Trails](/getting_started/trails)


# Lab 3: Build Controls
Source: https://docs.kosli.com/labs/lab-03-build-controls

Attest artifacts, attach JUnit test results, and generate and attest a Software Bill of Materials.

<Info>
  **Prerequisites**: Complete [Lab 2: Flows and Trails](/labs/lab-02-flows-and-trails) before starting this lab.
</Info>

## Learning goals

* Understand what attestations are and why they matter for compliance
* Attest a JAR file and Docker image as artifacts
* Attach JUnit test results as attestations
* Attach a Software Bill of Materials (SBOM) as an attestation
* Integrate all attestation commands into your CI/CD pipeline

## Introduction

**Attestations** are how you record facts about your software supply chain in Kosli. They are immutable pieces of evidence that prove certain activities occurred — like tests passing, security scans completing, or artifacts being built.

Kosli supports several attestation types:

* **Built-in**: `artifact`, `generic`, `junit`, `snyk`, `sonar`, `pull_request`, `jira`
* **Custom**: Types you define yourself with [`kosli create attestation-type`](/client_reference/kosli_create_attestation-type)

Each attestation is linked to a Trail and optionally to a specific artifact, creating an auditable chain of evidence.

### Artifact fingerprints

Kosli identifies artifacts by their **SHA256 fingerprint**. This uniquely identifies the artifact regardless of where it's stored or what it's named. The CLI can calculate fingerprints for:

* `--artifact-type file` — JAR files, binaries
* `--artifact-type dir` — source code, build outputs
* `--artifact-type docker` — images from local Docker daemon
* `--artifact-type oci` — images from container registries

<Tip>
  Using fingerprints ensures you're tracking the exact artifact, not just its name or tag. See [Artifacts](/getting_started/artifacts) for more.
</Tip>

## Exercise

<Steps>
  <Step title="Attest the application artifact (JAR)">
    In `.github/workflows/full-pipeline.yaml`, find the `Build` job and add this step after the "Build application" step:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
          - name: Attest application artifact
            run: |
              JAR_FILE=$(ls app/build/libs/app-*.jar)
              kosli attest artifact ${JAR_FILE} \
                --artifact-type file \
                --flow ${APP_NAME}-pipeline \
                --trail ${GIT_COMMIT} \
                --name application \
                --build-url ${BUILD_URL} \
                --commit-url ${COMMIT_URL}
    ```

    The `--name application` gives this artifact a logical name in your Flow. This name is used to attach further attestations (like tests) to this specific artifact.

    See [`kosli attest artifact`](/client_reference/kosli_attest_artifact) for full flag reference.
  </Step>

  <Step title="Attest JUnit test results">
    Still in the `Build` job, add this step after the test step:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
          - name: Attest JUnit test results
            run: |
              kosli attest junit \
                --flow ${APP_NAME}-pipeline \
                --trail ${GIT_COMMIT} \
                --name application.unit-tests \
                --results-dir app/build/test-results/test/
    ```

    <Tip>
      The dot notation (`application.unit-tests`) tells Kosli this attestation belongs to the `application` artifact. Attestations without a dot belong to the Trail itself.
    </Tip>

    Kosli automatically parses the JUnit XML to determine pass/fail status. See [`kosli attest junit`](/client_reference/kosli_attest_junit).
  </Step>

  <Step title="Attest the Docker image">
    In the `Docker-image` job, add these steps after the "push docker" step:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        - name: Setup Kosli CLI
          uses: kosli-dev/setup-cli-action@v5
          with:
            version: 2.28.0

        - name: Attest Docker image
          run: |
            IMAGE_NAME="ghcr.io/${IMAGE}:latest"
            kosli attest artifact ${IMAGE_NAME} \
              --artifact-type oci \
              --flow ${APP_NAME}-pipeline \
              --trail ${GIT_COMMIT} \
              --name docker-image \
              --build-url ${BUILD_URL} \
              --commit-url ${COMMIT_URL} \
              --registry-username ${{ github.actor }} \
              --registry-password ${{ secrets.GITHUB_TOKEN }}
    ```

    Using `--artifact-type oci` tells Kosli to fetch the image manifest directly from the registry, without needing Docker installed locally. This is more reliable in CI.
  </Step>

  <Step title="Generate and attest an SBOM">
    Your workflow already generates an SBOM using Anchore. Add this step to the `Docker-image` job after the "Generate SBOM" step:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        - name: Attest SBOM
          run: |
            IMAGE_NAME="ghcr.io/${IMAGE}:latest"
            kosli attest generic \
              --flow ${APP_NAME}-pipeline \
              --trail ${GIT_COMMIT} \
              --name docker-image.sbom \
              --artifact-type oci ${IMAGE_NAME} \
              --attachments sbom.spdx.json \
              --registry-username ${{ github.actor }} \
              --registry-password ${{ secrets.GITHUB_TOKEN }}
    ```

    The SBOM attestation is linked to the `docker-image` artifact via the `docker-image.sbom` name. Kosli stores the SBOM file in its Evidence Vault.

    <Tip>
      An SBOM (Software Bill of Materials) lists all components and dependencies in your software — crucial for tracking vulnerabilities and license compliance.
    </Tip>
  </Step>

  <Step title="Push and verify">
    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    git add .github/workflows/full-pipeline.yaml
    git commit -m "Add Kosli attestation steps"
    git push origin main
    ```

    Watch the workflow run and confirm all attestation steps complete successfully. Then in [app.kosli.com](https://app.kosli.com), navigate to your Flow → latest Trail and verify:

    * **Artifacts**: JAR file and Docker image with fingerprints
    * **Attestations**: Unit tests attached to `application`, SBOM attached to `docker-image`
    * **Timeline**: When each attestation was recorded

    Click individual attestations to view JUnit test counts and SBOM component details.
  </Step>
</Steps>

<Accordion title="Optional: attest vulnerability scans">
  Your workflow already runs Trivy security scans. You can extend this lab by attesting the scan results as a generic attestation:

  ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  export DOCKER_IMAGE="<your-gh-username>/labs"

  kosli attest generic \
    --flow labs-pipeline \
    --trail $(git rev-parse HEAD) \
    --name docker-image.security-scan \
    --artifact-type oci ghcr.io/${DOCKER_IMAGE}:latest \
    --compliant=true \
    --description "Trivy scan completed"
  ```

  In production you'd parse Trivy results and set `--compliant` based on severity thresholds.
</Accordion>

## Verification checklist

* [ ] Workflow updated with attestation steps
* [ ] All attestation steps pass in the workflow
* [ ] Artifacts visible in the Kosli Trail with fingerprints
* [ ] JUnit test results attached to the `application` artifact
* [ ] SBOM attached to the `docker-image` artifact

<Note>
  If anything didn't go to plan, refer to the reference solution at `pipelines/03-complete.yaml` in the [labs repository](https://github.com/kosli-dev/labs).
</Note>

## Next steps

Continue to [Lab 4: Release Controls](/labs/lab-04-release-controls) to define compliance requirements and gate deployments.

**Further reading:**

* [Attestations](/getting_started/attestations)
* [Artifacts](/getting_started/artifacts)


# Lab 4: Release Controls
Source: https://docs.kosli.com/labs/lab-04-release-controls

Define compliance requirements with Flow Templates and gate deployments with kosli assert artifact.

<Info>
  **Prerequisites**: Complete [Lab 3: Build Controls](/labs/lab-03-build-controls) before starting this lab.
</Info>

## Learning goals

* Understand Flow Templates and how they define compliance requirements
* Update an existing Flow to enforce specific attestations
* Understand the difference between compliant and non-compliant Trails
* Use `kosli assert artifact` to gate deployments based on compliance status

## Introduction

In the previous labs, you've been recording evidence (attestations) for your builds. However, recording evidence is only half the picture — you also need to ensure the *required* evidence is actually present before allowing a release.

**Flow Templates** define the "shape" of a compliant release. They specify:

* Which artifacts are expected in the Trail
* Which attestations are required for each artifact
* Which attestations are required at the Trail level

When a Trail is evaluated against its Flow Template, Kosli determines if it is <Badge>Compliant</Badge> or <Badge>Non-compliant</Badge>. By adding `kosli assert artifact` to your pipeline, you can automatically block deployments that don't meet your compliance standards.

See [Flow Templates](/template-reference/flow_template) for the full template specification.

## Exercise

<Steps>
  <Step title="Define compliance requirements">
    Create a file named `flow-template.yaml` in the root of your repository:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    # yaml-language-server: $schema=https://docs.kosli.com/schemas/flow-template/v1.json
    version: 1
    trail:
      artifacts:
        - name: application
          attestations:
            - name: unit-tests
              type: junit
        - name: docker-image
          attestations:
            - name: sbom
              type: generic
    ```

    This template matches the attestations you set up in Lab 3:

    1. An `application` artifact that must have `unit-tests`
    2. A `docker-image` artifact that must have an `sbom`
  </Step>

  <Step title="Update the Flow to use the template">
    In `.github/workflows/full-pipeline.yaml`, find the `Create/Update Flow` step (added in Lab 2) and replace `--use-empty-template` with `--template-file`:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
          - name: Create/Update Flow
            run: |
              kosli create flow ${APP_NAME}-pipeline \
                --description "CI/CD pipeline for ${APP_NAME} application" \
                --template-file flow-template.yaml
    ```
  </Step>

  <Step title="Gate the release">
    In the `Deploy` job, add the following steps **before** the "Deploy to production" step:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        - name: Setup Kosli CLI
          uses: kosli-dev/setup-cli-action@v5
          with:
            version: 2.28.0

        - name: Assert compliance
          run: |
            IMAGE_NAME="ghcr.io/${IMAGE}:latest"
            kosli assert artifact ${IMAGE_NAME} \
              --artifact-type oci \
              --flow ${APP_NAME}-pipeline
    ```

    This command asks Kosli: *"Is this artifact and its Trail compliant?"*

    * <Badge>Compliant</Badge> (all required attestations present and none failing): exits `0` — pipeline continues to deploy
    * <Badge>Non-compliant</Badge> (missing or failing attestations): exits `1` — pipeline fails, deployment is blocked

    See [`kosli assert artifact`](/client_reference/kosli_assert_artifact) for full flag reference.
  </Step>

  <Step title="Push and test the gate">
    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    git add flow-template.yaml .github/workflows/full-pipeline.yaml
    git commit -m "Add Flow Template and Release Gate"
    git push origin main
    ```

    Watch the workflow run. Since you're providing all required attestations from Lab 3, the `Assert compliance` step should pass (green).

    Then in [app.kosli.com](https://app.kosli.com), navigate to your Flow → latest Trail. The **Compliance** status should show <Badge>Compliant</Badge> with all template requirements checked off.
  </Step>
</Steps>

<Accordion title="Optional: test non-compliance">
  To see the gate in action, add a non-existent attestation requirement to `flow-template.yaml`:

  ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      - name: docker-image
        attestations:
          - name: sbom
            type: generic
          - name: performance-test  # We haven't implemented this yet!
            type: generic
  ```

  Commit and push. The `Assert compliance` step should **fail**, preventing the deploy step from running. The Trail in Kosli will be marked <Badge>Non-compliant</Badge>.

  <Warning>
    Remember to revert this change to make your pipeline green again.
  </Warning>
</Accordion>

## Verification checklist

* [ ] `flow-template.yaml` created in repository root
* [ ] Workflow updated to apply the template
* [ ] `kosli assert artifact` added to the Deploy job
* [ ] A fully attested build passes the compliance gate
* [ ] Trail shows as <Badge>Compliant</Badge> in the Kosli web interface

<Note>
  If anything didn't go to plan, refer to the reference solution at `pipelines/04-complete.yaml` in the [labs repository](https://github.com/kosli-dev/labs).
</Note>

## Next steps

Continue to [Lab 5: Runtime Controls](/labs/lab-05-runtime-controls) to track what's running in production and enforce compliance policies.

**Further reading:**

* [Flows](/getting_started/flows)
* [Flow Template reference](/template-reference/flow_template)


# Lab 5: Runtime Controls
Source: https://docs.kosli.com/labs/lab-05-runtime-controls

Create environments, snapshot what's running in production, and enforce compliance policies.

<Info>
  **Prerequisites**: Complete [Lab 4: Release Controls](/labs/lab-04-release-controls) before starting this lab.
</Info>

## Learning goals

* Understand Kosli Environments and how they track runtime state
* Create a Kosli Environment representing your deployment target
* Snapshot a Docker environment to report what's running
* Create and configure compliance Policies
* Attach Policies to Environments for enforcement
* Integrate environment snapshotting into your CI/CD pipeline

## Introduction

**Kosli Environments** allow you to track what's actually running in your runtime environments (dev, staging, production). By taking regular **snapshots**, Kosli creates an immutable record of:

* What artifacts are running, identified by their SHA256 digest
* When they started and stopped
* Whether they comply with your policies
* The complete change history over time

**Policies** define compliance requirements for environments — rules like "all artifacts must have provenance", "all artifacts must have passed unit tests", or "all artifacts must have an SBOM".

Together, Environments and Policies give you runtime visibility and enforcement for your software supply chain.

### Environment types

Kosli supports several environment types:

| Type     | Tracks                        |
| -------- | ----------------------------- |
| `docker` | Docker containers on a host   |
| `k8s`    | Kubernetes pods in namespaces |
| `ecs`    | AWS ECS tasks                 |
| `lambda` | AWS Lambda functions          |
| `s3`     | Files in S3 buckets           |
| `server` | Files on a server filesystem  |

See [Environments](/getting_started/environments) for more.

## Exercise

<Steps>
  <Step title="Create an environment">
    Your application deploys as a Docker container, so create a `docker` type environment:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create environment labs-prod \
      --type docker \
      --description "Production environment for labs application"

    # Verify it was created
    kosli get environment labs-prod
    ```

    Visit [app.kosli.com](https://app.kosli.com) → **Environments** and you should see `labs-prod` listed (with no snapshots yet).

    See [`kosli create environment`](/client_reference/kosli_create_environment) for full flag reference.
  </Step>

  <Step title="Explore an existing environment">
    To see a real-world example, navigate to the [Cyber-Dojo AWS Beta environment](https://app.kosli.com/cyber-dojo/environments/aws-beta/snapshots/).

    Here you can see a history of snapshots taken from a production AWS environment. Each snapshot shows:

    * **Running artifacts**: Container images currently running
    * **Compliance status**: Whether they meet policy requirements
    * **Events**: What started or stopped since the last snapshot
    * **Duration**: How long the application has been running

    <Tip>
      Each snapshot is immutable. If nothing changed since the last snapshot, Kosli won't create a new one — only real changes produce new snapshots.
    </Tip>
  </Step>

  <Step title="Integrate snapshotting into CI">
    In `.github/workflows/full-pipeline.yaml`, add this step to the `Deploy` job **after** the "Deploy to production" step:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        - name: Snapshot environment
          run: kosli snapshot docker labs-prod
    ```

    This captures what's running immediately after deployment.
  </Step>

  <Step title="Create a compliance policy">
    Create `.kosli-policy.yml` in the root of your repository:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    _schema: https://docs.kosli.com/schemas/policy/v1

    artifacts:
      provenance:
        required: true  # All artifacts must be part of a Flow

      attestations:
        - name: unit-tests
          type: junit
        - name: sbom
          type: "*"  # Any attestation type
    ```

    This policy requires:

    1. All running artifacts must have been attested to Kosli (provenance)
    2. All artifacts must have JUnit test results
    3. All artifacts must have an SBOM

    Then create the policy in Kosli:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create policy labs-prod-requirements .kosli-policy.yml

    # View it
    kosli get policy labs-prod-requirements
    ```

    See [`kosli create policy`](/client_reference/kosli_create_policy) and [Policies](/getting_started/policies) for more details.
  </Step>

  <Step title="Attach the policy to your environment">
    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attach-policy labs-prod-requirements --environment labs-prod

    # Verify attachment
    kosli get environment labs-prod
    ```

    <Tip>
      Attaching a policy automatically triggers a new snapshot evaluation. Kosli immediately checks if currently running artifacts meet the requirements.
    </Tip>

    See [`kosli attach-policy`](/client_reference/kosli_attach-policy) for full flag reference.
  </Step>

  <Step title="Add policy management to CI">
    In the `Deploy` job, add these steps **before** the "Assert compliance" step:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        - name: Update policy
          run: kosli create policy labs-prod-requirements .kosli-policy.yml
        - name: Attach policy to environment
          run: kosli attach-policy labs-prod-requirements --environment labs-prod
    ```
  </Step>

  <Step title="Push and verify">
    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    git add .kosli-policy.yml .github/workflows/full-pipeline.yaml
    git commit -m "Add Kosli environment and policy management"
    git push origin main
    ```

    Watch the workflow execute. After it completes, in [app.kosli.com](https://app.kosli.com):

    * Navigate to **Environments → labs-prod** → latest snapshot
    * Check the compliance status — it should be <Badge>Compliant</Badge>, since you've been attesting unit tests and SBOM since Lab 3
    * Click on the running artifact to see which attestations are present

    <Accordion title="If your artifact is non-compliant">
      - Verify the attestation names in your workflow match the names in `.kosli-policy.yml` exactly
      - Check that all attestation steps completed successfully in the previous workflow run
      - Confirm the artifact fingerprint matches what was attested
    </Accordion>
  </Step>
</Steps>

<Accordion title="Optional: policy enforcement gate">
  You can also use policies as deployment gates, preventing non-compliant artifacts from deploying:

  ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  # Assert against specific policies before deployment
  kosli assert artifact ghcr.io/${IMAGE}:latest \
    --policy labs-prod-requirements
  ```

  If the artifact is non-compliant, this command exits with a non-zero status, failing the deployment step.

  See [`kosli assert artifact`](/client_reference/kosli_assert_artifact) for more details.
</Accordion>

<Accordion title="Optional: policy expressions">
  Policies support conditional logic for sophisticated compliance rules:

  ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  artifacts:
    attestations:
      # Only require security scans for production flow
      - if: ${{ flow.name == "production" }}
        name: security-scan
        type: snyk

      # Exceptions for specific artifacts
      - name: unit-tests
        type: junit
        exceptions:
          - if: ${{ artifact.name == "legacy-component" }}
  ```

  See [Policy expressions](/policy-reference/environment_policy#policy-expressions) for more.
</Accordion>

## Verification checklist

* [ ] `labs-prod` environment of type `docker` created
* [ ] Explored the Cyber-Dojo environment in Kosli
* [ ] `.kosli-policy.yml` created with compliance requirements
* [ ] Policy created in Kosli and attached to the environment
* [ ] Workflow updated with policy update and snapshot steps
* [ ] Workflow runs successfully
* [ ] Environment snapshots visible in Kosli
* [ ] Running artifact shows as <Badge>Compliant</Badge>

## Congratulations!

You've completed all five Kosli Learning Labs. You now know how to:

1. Set up Kosli and integrate it with a CI/CD pipeline
2. Create Flows and Trails to track your software delivery process
3. Attest artifacts and attach evidence (tests, SBOMs, scans)
4. Define compliance requirements and gate releases
5. Create environments, track what's running, and enforce policies

You have full visibility and control over your software supply chain, from build to deployment.

## Explore further

* [Custom attestation types](/getting_started/attestations) for your specific tools
* [Kubernetes environment reporting](/tutorials/report_k8s_envs) if you use K8s

**Further reading:**

* [Environments](/getting_started/environments)
* [Policies](/getting_started/policies)


# Environment Policy
Source: https://docs.kosli.com/policy-reference/environment_policy

Reference for the YAML policy files used to define compliance requirements for Kosli environments.

An environment policy is a YAML file that declares compliance requirements for artifacts running in a Kosli environment. You pass the file to [`kosli create policy`](/client_reference/kosli_create_policy) to create or update a policy. For concepts, workflow, and enforcement, see [Environment Policies](/getting_started/policies).

<Tip>
  Prefer to build a policy interactively? Use the [Policy builder](/policy-reference/policy_builder) to assemble a valid policy file in your browser and copy the YAML.
</Tip>

## Specification

<ParamField type="string">
  Version identifier and [JSON Schema](https://docs.kosli.com/schemas/policy/v1.json) URL for the policy format. The final path segment must match `/v{n}` where `n` is a supported major version. Currently only `v1` is supported.

  ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  # yaml-language-server: $schema=https://docs.kosli.com/schemas/policy/v1.json
  _schema: https://docs.kosli.com/schemas/policy/v1
  ```
</ParamField>

<ParamField type="object">
  Rules applied to artifacts in an environment snapshot. Omitted keys use server defaults.

  <Expandable title="artifacts properties">
    <ParamField type="object">
      Requires artifacts to have provenance (i.e., be part of a Kosli flow).

      <Expandable title="provenance properties">
        <ParamField type="boolean">
          When `true`, every artifact in the snapshot must have provenance.
        </ParamField>

        <ParamField type="array">
          List of conditions under which the provenance requirement is waived. Each element is an object with a single `if` key containing a [policy expression](#policy-expressions).

          ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
          exceptions:
            - if: ${{ matches(artifact.name, "^datadog:.*") }}
          ```
        </ParamField>
      </Expandable>
    </ParamField>

    <ParamField type="object">
      Requires artifacts to belong to a compliant trail in their flow.

      <Expandable title="trail-compliance properties">
        <ParamField type="boolean">
          When `true`, every artifact must be part of a compliant trail.
        </ParamField>

        <ParamField type="array">
          List of conditions under which the trail-compliance requirement is waived. Same structure as `provenance.exceptions`.
        </ParamField>
      </Expandable>
    </ParamField>

    <ParamField type="array">
      List of attestations every artifact must have. Each element is a required-attestation rule.

      <Expandable title="attestation rule properties">
        <ParamField type="string">
          The [attestation type](#attestation-types) to require. Cannot be `*` when `name` is also `*`.
        </ParamField>

        <ParamField type="string">
          Attestation name to match. `*` matches any name. Cannot be `*` when `type` is also `*`.
        </ParamField>

        <ParamField type="string">
          A [policy expression](#policy-expressions). When present, this attestation is only required when the expression evaluates to `true`.
        </ParamField>
      </Expandable>
    </ParamField>
  </Expandable>
</ParamField>

## Attestation types

| Value           | Description                                                                                                    |
| --------------- | -------------------------------------------------------------------------------------------------------------- |
| `generic`       | Generic attestation                                                                                            |
| `junit`         | JUnit test results                                                                                             |
| `snyk`          | Snyk security scan                                                                                             |
| `pull_request`  | Pull request evidence                                                                                          |
| `jira`          | Jira ticket reference                                                                                          |
| `sonar`         | SonarQube analysis                                                                                             |
| `*`             | Matches any built-in or custom type                                                                            |
| `custom:<name>` | A [custom attestation type](/client_reference/kosli_create_attestation-type) (e.g., `custom:coverage-metrics`) |

## Policy expressions

Expressions are boolean conditions evaluated against flow and artifact context. They are wrapped in `${{ }}` and can appear in `if` and `exceptions[].if` fields.

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
if: ${{ flow.tags.risk-level == "high" and matches(artifact.name, "^prod:.*") }}
```

### Operators

| Operator | Category   | Example                                     |
| -------- | ---------- | ------------------------------------------- |
| `==`     | Comparison | `flow.name == "runner"`                     |
| `!=`     | Comparison | `flow.tags.risk-level != "high"`            |
| `<`      | Comparison | `flow.tags.priority < 3`                    |
| `>`      | Comparison | `flow.tags.priority > 1`                    |
| `<=`     | Comparison | `flow.tags.risk-level <= 2`                 |
| `>=`     | Comparison | `flow.tags.risk-level >= 2`                 |
| `and`    | Logical    | `flow.name == "a" and artifact.name == "b"` |
| `or`     | Logical    | `flow.name == "a" or flow.name == "b"`      |
| `not`    | Logical    | `not flow.tags.risk-level == "high"`        |
| `in`     | Membership | `flow.name in ["runner", "saver"]`          |

Parentheses control precedence: `${{ flow.name == 'prod' and (flow.tags.team == "a" or artifact.name == 'svc') }}`.

### Contexts

<ParamField type="object">
  Information about the Kosli flow the artifact belongs to.

  <Expandable title="flow properties">
    <ParamField type="string">
      Name of the flow.
    </ParamField>

    <ParamField type="object">
      Flow tags, accessed by key: `flow.tags.risk-level`, `flow.tags.team`. Keys containing dots are supported: `flow.tags.key.with.dots`.
    </ParamField>
  </Expandable>
</ParamField>

<ParamField type="object">
  Information about the artifact being evaluated.

  <Expandable title="artifact properties">
    <ParamField type="string">
      Name of the artifact.
    </ParamField>

    <ParamField type="string">
      SHA256 fingerprint of the artifact.
    </ParamField>
  </Expandable>
</ParamField>

### Functions

| Function                | Description                                               | Example                                        |
| ----------------------- | --------------------------------------------------------- | ---------------------------------------------- |
| `exists(arg)`           | Returns `true` if `arg` is not null.                      | `${{ exists(flow) }}`                          |
| `matches(input, regex)` | Returns `true` if `input` matches the regular expression. | `${{ matches(artifact.name, "^datadog:.*") }}` |

## Constraints

* `_schema` is the only required field. All other fields are optional and use server defaults when omitted.
* An attestation rule must not have both `name` and `type` set to `*`.
* Expressions must evaluate to a boolean. An invalid expression causes a policy evaluation error.

## Example

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# yaml-language-server: $schema=https://docs.kosli.com/schemas/policy/v1.json
_schema: https://docs.kosli.com/schemas/policy/v1

artifacts:
  provenance:
    required: true
    exceptions:
      - if: ${{ matches(artifact.name, "^datadog:.*") }}

  trail-compliance:
    required: true

  attestations:
    - name: security-scan
      type: snyk
    - name: pull-request
      type: pull_request
      if: ${{ flow.tags.risk-level == "high" }}
    - name: coverage
      type: custom:coverage-metrics
```

## Editor validation

The `_schema` URL resolves to a [JSON Schema](https://docs.kosli.com/schemas/policy/v1.json) for the environment policy format. To enable inline validation and autocomplete in VS Code (requires the [YAML extension](https://marketplace.visualstudio.com/items?itemName=redhat.vscode-yaml)) and other schema-aware editors, add a `yaml-language-server` directive:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# yaml-language-server: $schema=https://docs.kosli.com/schemas/policy/v1.json
_schema: https://docs.kosli.com/schemas/policy/v1
```

## See also

* [Policy builder](/policy-reference/policy_builder) — build a policy file interactively in the browser
* [Environment Policies](/getting_started/policies) — concepts, workflow, and enforcement
* [`kosli create policy`](/client_reference/kosli_create_policy) — create or update a policy
* [`kosli attach-policy`](/client_reference/kosli_attach-policy) — attach a policy to an environment
* [`kosli assert artifact`](/client_reference/kosli_assert_artifact) — enforce policies on an artifact
* [Terraform: kosli\_policy](/terraform-reference/resources/policy) — manage policies via Terraform


# Environment Policy Builder
Source: https://docs.kosli.com/policy-reference/policy_builder

Build a Kosli environment policy YAML interactively in the browser and copy the result into your repo.

Use this builder to assemble an [environment policy](/policy-reference/environment_policy). Toggle the requirements you need, add attestation rules and exceptions, then copy the generated YAML into a file in your repo.

The output conforms to the [v1 policy schema](https://docs.kosli.com/schemas/policy/v1.json) and runs entirely in your browser — nothing is sent to Kosli.

<PolicyBuilder />

## Next steps

* Save the YAML as a file (e.g. `policy.yaml`) in your repo.
* Create or update the policy with [`kosli create policy`](/client_reference/kosli_create_policy).
* Attach it to an environment with [`kosli attach-policy`](/client_reference/kosli_attach-policy).

## See also

* [Environment Policy](/policy-reference/environment_policy) — full schema reference and field descriptions
* [Environment Policies](/getting_started/policies) — concepts, workflow, and enforcement


# Rego Policy
Source: https://docs.kosli.com/policy-reference/rego_policy

Reference for Rego policy files used with kosli evaluate trail and kosli evaluate trails.

A Rego policy defines the rules Kosli evaluates trail data against. You pass a `.rego` file to [`kosli evaluate trail`](/client_reference/kosli_evaluate_trail) or [`kosli evaluate trails`](/client_reference/kosli_evaluate_trails) via the `--policy` flag. Kosli includes a built-in <Tooltip href="https://www.openpolicyagent.org/">Rego</Tooltip> evaluator with no OPA installation required.

## Policy contract

These rules are Kosli-specific conventions, not OPA built-ins. Kosli queries `data.policy.*` to find them.

<ParamField>
  Every policy must declare `package policy`. Kosli queries `data.policy.allow` and `data.policy.violations` to read the result.
</ParamField>

<ParamField type="boolean">
  Must evaluate to a boolean. Kosli exits with code `0` when `true`, code `1` when `false`.

  Always define `allow` with a fail-safe default and drive it through a positive assertion, not through the absence of violations. See [Safe policy design](#safe-policy-design).

  ```rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  default allow := false

  allow if trail_is_compliant(input.trail)
  ```
</ParamField>

<ParamField type="set of strings">
  Optional but recommended. A set of human-readable strings explaining why the policy denied. Kosli displays these when `allow` is `false`. Each message should identify the offending resource and the reason.

  Violations are diagnostics only. They must not drive the `allow` decision. See [Safe policy design](#safe-policy-design).

  ```rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  violations contains msg if {
      # ... rule body ...
      msg := sprintf("descriptive message about %v", [resource])
  }
  ```
</ParamField>

## Safe policy design

Three rules prevent a policy from incorrectly reporting a non-compliant trail as compliant.

### Rule 1: use a fail-safe default

Always start with `default allow := false`. A trail must be explicitly approved rather than allowed by the absence of evidence against it.

Use parameter aliases at the top of the policy file rather than hardcoding threshold values. If a required param is absent from the params file, any rule that references its alias will fail to evaluate, and `allow` will correctly remain `false`.

```rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
max_days_by_severity   := data.params.max_days_by_severity
max_ignore_expiry_days := data.params.max_ignore_expiry_days
```

See [Evaluate trails with OPA policies](/tutorials/evaluate_trails_with_opa) for a detailed walkthrough.

### Rule 2: drive `allow` through positive assertions

Drive the `allow` decision through a condition that must be true for the trail to be compliant. Do not write:

```rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# Unsafe: allow depends on the absence of violations
allow if {
    count(violations) == 0
}
```

When a `violations` rule body encounters an undefined reference, such as a missing param or an absent attestation field, OPA silently skips that rule body and adds no message to the set. The set is then empty, `count(violations) == 0` evaluates to `true`, and `allow` fires even though the policy never verified compliance. This produces a false-positive compliant result.

The safe pattern makes compliance explicit:

```rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# Safe: allow fires only when trail_is_compliant is positively true
allow if trail_is_compliant(input.trail)
```

If any field referenced inside `trail_is_compliant` is undefined, the rule body fails to evaluate and `allow` remains `false`.

See [Evaluate trails with OPA policies](/tutorials/evaluate_trails_with_opa) for a detailed walkthrough.

### Rule 3: violations are diagnostics only

In a `violations` rule, an undefined reference causes the rule body to fail silently: no message is added. This is the safe failure mode for diagnostics. Violations explain a denial determined by the `allow` rule and must not determine it themselves.

See [Evaluate trails with OPA policies](/tutorials/evaluate_trails_with_opa) for a detailed walkthrough.

## Params

Policies can read external configuration via the `--params` flag. Params are available in the policy as `data.params.*`. This separates policy logic from the thresholds it enforces, so one `.rego` file can cover multiple environments with different params files.

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# Inline JSON
kosli evaluate trail "$TRAIL_NAME" \
  --policy my-policy.rego \
  --params '{"max_high": 0}' \
  --org "$ORG" \
  --flow "$FLOW"

# JSON file
kosli evaluate trail "$TRAIL_NAME" \
  --policy my-policy.rego \
  --params @rego.params.prod.json \
  --org "$ORG" \
  --flow "$FLOW"
```

Alias params at the top of the policy file so that missing values cause rules to fail rather than silently proceeding:

```rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
max_high := data.params.max_high
```

If `max_high` is absent, `max_high` is undefined and any rule that references it fails to evaluate, leaving `allow` at its `false` default.

## Input data

The data structure passed to the policy as `input` depends on which command you use.

### Single trail (`kosli evaluate trail`)

The policy receives `input.trail`, a single trail object.

<ParamField type="object">
  The trail being evaluated.

  <Expandable title="trail properties">
    <ParamField type="string">
      The trail name (git commit SHA or custom name).
    </ParamField>

    <ParamField type="object">
      Compliance data for the trail.

      <Expandable title="compliance_status properties">
        <ParamField type="boolean">
          Whether the trail is compliant against its flow template.
        </ParamField>

        <ParamField type="string">
          Compliance status string, e.g. `"COMPLIANT"` or `"INCOMPLIANT"`.
        </ParamField>

        <ParamField type="object">
          Map of attestation name to attestation status object. Each object contains the attestation's data, including type-specific fields enriched via `--attestations`. For example, a `pull-request` attestation includes a `pull_requests` array, each with an `approvers` array and a `url` string.
        </ParamField>

        <ParamField type="object">
          Map of artifact name to artifact status object. Each artifact has its own `attestations_statuses` map with the same structure as above.
        </ParamField>
      </Expandable>
    </ParamField>
  </Expandable>
</ParamField>

### Multiple trails (`kosli evaluate trails`)

The policy receives `input.trails`, an array of trail objects with the same structure as `input.trail` above.

<ParamField type="array">
  Array of trail objects. Each element has the same structure as `input.trail` described above.
</ParamField>

<Info>
  Use `--show-input` with `--output json` to print the full input structure for a given trail. Pipe through `jq` to explore specific fields:

  ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  kosli evaluate trail "$TRAIL_NAME" \
    --policy my-policy.rego \
    --org "$ORG" \
    --flow "$FLOW" \
    --show-input \
    --output json 2>/dev/null | jq '.input'
  ```
</Info>

## Local testing

Use [`kosli evaluate input`](/client_reference/kosli_evaluate_input) to test a policy against captured trail data without making live Kosli API calls:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# Capture trail data once
kosli evaluate trail "$TRAIL_NAME" \
  --policy allow-all.rego \
  --show-input --output json | jq '.input' > trail-data.json

# Iterate on the policy locally
kosli evaluate input \
  --input-file trail-data.json \
  --policy my-policy.rego \
  --params '{"max_high": 0}'
```

## Exit codes

| Code | Meaning                                                                                                     |
| ---- | ----------------------------------------------------------------------------------------------------------- |
| `0`  | Policy allowed (`allow = true`)                                                                             |
| `1`  | Policy denied (`allow = false`) **or** command error (network failure, invalid Rego, policy file not found) |

Exit code `1` is used for both denial and failure. To distinguish between them in CI, use `--output json` and read the `allow` field directly from the output rather than relying on the exit code.

## Examples

### Check pull request approvals across multiple trails

Allows only when every trail in `input.trails` has at least one pull request with at least one approver. The attestation name is read from params so the same policy works across orgs that use different naming conventions.

```rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
package policy

import rego.v1

pr_attestation_name := data.params.pr_attestation_name

default allow := false

trail_has_approved_pr(trail) if {
    some pr in trail.compliance_status.attestations_statuses[pr_attestation_name].pull_requests
    count(pr.approvers) > 0
}

allow if {
    every trail in input.trails {
        trail_has_approved_pr(trail)
    }
}

violations contains msg if {
    some trail in input.trails
    some pr in trail.compliance_status.attestations_statuses[pr_attestation_name].pull_requests
    count(pr.approvers) == 0
    msg := sprintf("trail '%v': pull-request %v has no approvers", [trail.name, pr.url])
}
```

### Check Snyk scan results on a single trail

Allows only when every artifact in the trail has a Snyk scan where the high-severity vulnerability count does not exceed `max_high`. Both the attestation name and the threshold are read from params.

```rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
package policy

import rego.v1

snyk_attestation_name := data.params.snyk_attestation_name
max_high              := data.params.max_high

default allow := false

artifact_within_threshold(artifact) if {
    snyk := artifact.attestations_statuses[snyk_attestation_name]
    every result in snyk.processed_snyk_results.results {
        result.high_count <= max_high
    }
}

trail_is_compliant(trail) if {
    every name, artifact in trail.compliance_status.artifacts_statuses {
        artifact_within_threshold(artifact)
    }
}

allow if trail_is_compliant(input.trail)

violations contains msg if {
    some name, artifact in input.trail.compliance_status.artifacts_statuses
    snyk := artifact.attestations_statuses[snyk_attestation_name]
    some result in snyk.processed_snyk_results.results
    result.high_count > max_high
    msg := sprintf("artifact '%v': snyk scan found %d high severity vulnerabilities (limit: %d)", [name, result.high_count, max_high])
}
```

## Further reading

* [Rego Style Guide](https://www.openpolicyagent.org/docs/style-guide): naming, rule structure, and test conventions
* [OPA Annotations](https://www.openpolicyagent.org/docs/policy-language#annotations): including `entrypoint: true` for use with `opa build`
* [Tutorial: Evaluate trails with OPA policies](/tutorials/evaluate_trails_with_opa)


# Flow Template
Source: https://docs.kosli.com/template-reference/flow_template

Reference for the YAML template file used to define compliance controls for a Kosli flow.

A flow template defines what attestations are required for a trail and its artifacts to be compliant. You pass the template file when creating or updating a flow with [`kosli create flow --template-file`](/client_reference/kosli_create_flow).

## Specification

<ParamField type="integer">
  The version of the specification schema. Currently only `1` is supported.
</ParamField>

<ParamField type="object">
  The trail specification. Defines what must be attested at the trail level and what artifacts are expected.

  <Expandable title="trail properties">
    <ParamField type="array">
      Attestations required at the trail level for it to be compliant.

      <Expandable title="attestation properties">
        <ParamField type="string">
          A unique name for the attestation within this template.
        </ParamField>

        <ParamField type="string">
          The attestation type. One of: `generic`, `jira`, `junit`, `pull_request`, `snyk`, `sonar`, `*` (matches any type).
        </ParamField>
      </Expandable>
    </ParamField>

    <ParamField type="array">
      Artifacts expected to be produced in the trail. Each artifact can have its own attestation requirements.

      <Expandable title="artifact properties">
        <ParamField type="string">
          A reference name for the artifact (e.g. `frontend-app`, `backend`).
        </ParamField>

        <ParamField type="array">
          Attestations required for this artifact to be compliant.

          <Expandable title="attestation properties">
            <ParamField type="string">
              A unique name for the attestation within this artifact.
            </ParamField>

            <ParamField type="string">
              The attestation type. One of: `generic`, `jira`, `junit`, `pull_request`, `snyk`, `sonar`, or `custom:<custom-type-name>` for [custom attestation types](/client_reference/kosli_create_attestation-type).
            </ParamField>
          </Expandable>
        </ParamField>
      </Expandable>
    </ParamField>
  </Expandable>
</ParamField>

## Example

Add the `$schema` comment to get editor validation and autocomplete:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# yaml-language-server: $schema=https://docs.kosli.com/schemas/flow-template/v1.json
version: 1
trail:
  attestations:
  - name: jira-ticket
    type: jira
  - name: risk-level-assessment
    type: generic
  artifacts:
  - name: backend
    attestations:
    - name: unit-tests
      type: junit
    - name: security-scan
      type: snyk
  - name: frontend
    attestations:
    - name: manual-ui-test
      type: generic
    - name: coverage-metrics
      type: custom:coverage-metrics
```

## Using the template

Pass the template file when creating or updating a flow:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create flow my-flow --template-file ./flow-template.yml
```

Once the flow exists, start a trail with [`kosli begin trail`](/client_reference/kosli_begin_trail) and record attestations using the [`kosli attest`](/client_reference/kosli_attest_generic) commands. Kosli evaluates trail compliance against the template automatically.

<Info>
  Trail-level attestations apply to the entire trail. Artifact-level attestations apply to a specific artifact produced within the trail.
</Info>

## Editor validation

A [JSON Schema](https://docs.kosli.com/schemas/flow-template/v1.json) is available for the flow template format. Add the following comment to the top of your template file to enable inline validation and autocomplete in VS Code (requires the [YAML extension](https://marketplace.visualstudio.com/items?itemName=redhat.vscode-yaml)) and other schema-aware editors:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# yaml-language-server: $schema=https://docs.kosli.com/schemas/flow-template/v1.json
```


# kosli_action data source
Source: https://docs.kosli.com/terraform-reference/data-sources/action

Fetches details of an existing Kosli action.

Fetches details of an existing Kosli action.

Use this data source to reference existing actions and access metadata such as the environments being monitored and the trigger types configured.

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Query an existing action
data "kosli_action" "compliance_alerts" {
  name = "compliance-alerts"
}

output "action_number" {
  description = "Server-assigned number of the action"
  value       = data.kosli_action.compliance_alerts.number
}

output "action_environments" {
  description = "Environments monitored by this action"
  value       = data.kosli_action.compliance_alerts.environments
}
```

## Schema

### Required

* `name` (String) The name of the action to query.

### Read-only

* `created_by` (String) User who created the action.
* `environments` (List of String) List of environment names this action monitors.
* `last_modified_at` (Number) Unix timestamp (with fractional seconds) of when the action was last modified.
* `number` (Number) Server-assigned numeric identifier for the action.
* `triggers` (List of String) List of trigger event types that activate this action.


# kosli_control data source
Source: https://docs.kosli.com/terraform-reference/data-sources/control

Fetches details of an existing Kosli control. Use this data source to reference controls and access metadata such as the version, tags, and referencing policies.

Fetches details of an existing Kosli control. Use this data source to reference controls and access metadata such as the version, tags, and referencing policies.

<Warning>
  Controls is a **beta** feature and must be enabled for your organization; API requests return `403 Forbidden` otherwise.
</Warning>

Use this data source to:

* Reference an existing control managed outside Terraform
* Read control metadata such as `version`, `tags`, and `policies_referencing`
* Read a specific historical version of a control's `name`, `description`, and `links`
* Read a previously-archived control by opting in with `archived = true`

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Create a control
resource "kosli_control" "binary_provenance" {
  identifier  = "SDLC-001"
  name        = "Binary provenance"
  description = "All production artifacts must have build provenance attestations"
}

# Look up the control via data source
data "kosli_control" "binary_provenance" {
  identifier = kosli_control.binary_provenance.identifier
}

# Reference control metadata
output "control_version" {
  description = "Current version of the control"
  value       = data.kosli_control.binary_provenance.version
}

output "control_policies" {
  description = "Environment policies referencing the control"
  value       = data.kosli_control.binary_provenance.policies_referencing
}

output "control_tags" {
  description = "Tags on the control"
  value       = data.kosli_control.binary_provenance.tags
}
```

## Read-only access

Data sources provide read-only access to control metadata. To create or modify controls, use the [`kosli_control` resource](/terraform-reference/resources/control).

## Schema

### Required

* `identifier` (String) The unique identifier of the control to query (e.g. `SDLC-001`).

### Optional

* `archived` (Boolean) Whether the control is archived. Deleting a `kosli_control` resource archives the control rather than hard-deleting it, and by default reading an archived control fails as if it did not exist. Set to `true` to read an archived control. Defaults to `false`.
* `version` (Number) Version of the control to read. Every update to a control creates a new version; set this to read the `name`, `description`, and `links` of a specific version. Defaults to the latest version.

### Read-only

* `created_at` (String) RFC3339 UTC timestamp of when the control was created. When `version` is set, this is when that version was created.
* `created_by` (String) Identifier of the user who created the control. When `version` is set, this is who created that version.
* `description` (String) The description of the control.
* `links` (Map of String) Named links related to the control, as a map of link name to URL.
* `name` (String) Human-readable display name of the control.
* `policies_referencing` (List of String) Names of the environment policies that reference this control.
* `status` (String) Status of the requested version (e.g. `created`). Only populated when `version` is set; the latest-control endpoint does not report a status.
* `tags` (Map of String) Tags on the control, as a map of tag key to value.


# kosli_custom_attestation_type data source
Source: https://docs.kosli.com/terraform-reference/data-sources/custom_attestation_type

Fetches details of an existing custom attestation type from Kosli. Custom attestation types define how Kosli validates and evaluates evidence from proprietary tools, custom metrics, or specialized compliance requirements.

Fetches details of an existing custom attestation type from Kosli. Custom attestation types define how Kosli validates and evaluates evidence from proprietary tools, custom metrics, or specialized compliance requirements.

Use this data source to retrieve information about an existing custom attestation type. This is useful for:

* Referencing existing attestation types in other configurations
* Creating variants of existing types with modified rules
* Querying attestation type metadata and schemas

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Query an existing custom attestation type
data "kosli_custom_attestation_type" "security" {
  name = "security-scan"
}

# Use the queried schema in a new attestation type
resource "kosli_custom_attestation_type" "security_strict" {
  name        = "security-scan-strict"
  description = "Stricter security requirements"

  # Reuse the schema and summary rows from the existing type
  schema  = data.kosli_custom_attestation_type.security.schema
  summary = data.kosli_custom_attestation_type.security.summary

  # Apply stricter validation rules
  jq_rules = [
    ".critical_vulnerabilities == 0",
    ".high_vulnerabilities == 0",
    ".medium_vulnerabilities < 3"
  ]
}

# Reference attestation type metadata
output "security_scan_description" {
  description = "Description of the security scan attestation type"
  value       = data.kosli_custom_attestation_type.security.description
}

output "security_scan_rules" {
  description = "JQ rules for the security scan attestation type"
  value       = data.kosli_custom_attestation_type.security.jq_rules
}

output "security_scan_summary" {
  description = "Summary rows shown on the attestation detail page, as a JSON array"
  value       = data.kosli_custom_attestation_type.security.summary
}

output "security_scan_archived" {
  description = "Whether the security scan attestation type is archived"
  value       = data.kosli_custom_attestation_type.security.archived
}
```

## Querying archived types

By default, the data source retrieves active (non-archived) attestation types. Archived types can be queried but are read-only and typically represent historical configurations.

The `archived` attribute indicates whether an attestation type has been deleted/archived in Kosli. Archived types cannot be modified through Terraform.

## Schema

### Required

* `name` (String) The name of the custom attestation type. Must start with a letter or number and contain only letters, numbers, periods, hyphens, underscores, and tildes.

### Read-only

* `archived` (Boolean) Whether this attestation type has been archived.
* `description` (String) A description of what this attestation type validates.
* `jq_rules` (List of String) List of jq expressions that define evaluation rules. All rules must evaluate to `true` for compliance.
* `schema` (String) JSON Schema that defines the structure of attestation data.
* `summary` (String) JSON array of ordered, labelled jq expressions rendered as rows on the attestation detail page in Kosli. Each element is an object with a `name` and an `expression`. Null when the type defines no summary.


# kosli_environment data source
Source: https://docs.kosli.com/terraform-reference/data-sources/environment

Fetches details of an existing Kosli environment. Use this data source to reference environments and access metadata like last modified and last reported timestamps.

Fetches details of an existing Kosli environment. Use this data source to reference environments and access metadata like last modified and last reported timestamps.

Environments represent runtime locations where artifacts are deployed and tracked for compliance monitoring. Use this data source to:

* Reference existing environment configurations in other resources
* Monitor environment activity (last modified, last reported timestamps)
* Create conditional logic based on environment state
* Build alerts and notifications based on environment metadata

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Query an existing environment
data "kosli_environment" "production" {
  name = "production-k8s"
}

# Use the data source to create a similar environment
resource "kosli_environment" "staging" {
  name        = "staging-k8s"
  type        = data.kosli_environment.production.type
  description = "Staging environment similar to ${data.kosli_environment.production.name}"
}

# Reference environment metadata for monitoring
output "production_last_modified" {
  description = "Timestamp of when production environment was last modified"
  value       = data.kosli_environment.production.last_modified_at
}

output "production_last_reported" {
  description = "Timestamp of when production environment last reported a snapshot"
  value       = data.kosli_environment.production.last_reported_at
}

output "production_type" {
  description = "Type of the production environment"
  value       = data.kosli_environment.production.type
}

# Access tags applied to the environment
output "production_tags" {
  description = "Tags applied to the production environment"
  value       = data.kosli_environment.production.tags
}

# Check if a specific tag exists
output "production_managed_by" {
  description = "Who manages the production environment (from tags)"
  value       = try(data.kosli_environment.production.tags["managed-by"], "unknown")
}

# Conditional logic based on environment metadata
locals {
  # Check if environment has never reported a snapshot
  needs_attention = data.kosli_environment.production.last_reported_at == null
}

output "production_needs_attention" {
  description = "Whether production environment needs attention (never reported)"
  value       = local.needs_attention
}
```

## Monitoring with data sources

The data source exposes timestamp fields that are useful for monitoring:

* `last_modified_at`: Unix timestamp of when the environment configuration was last changed
* `last_reported_at`: Unix timestamp of when the environment last reported a snapshot (can be null if never reported)

These timestamps enable you to:

* Create alerts for environments that haven't reported in a certain time period
* Track configuration changes across your infrastructure
* Build dashboards showing environment activity
* Implement conditional deployment logic based on environment state

## Read-only access

Data sources provide read-only access to environment metadata. To modify environment configurations, use the [`kosli_environment` resource](/terraform-reference/resources/environment).

## Schema

### Required

* `name` (String) The name of the environment to query.

### Read-only

* `description` (String) The description of the environment.
* `last_modified_at` (Number) Unix timestamp (with fractional seconds) of when the environment was last modified.
* `last_reported_at` (Number) Unix timestamp (with fractional seconds) of when the environment was last reported. May be null if never reported.
* `tags` (Map of String) Key-value pairs tagging the environment.
* `type` (String) The environment type (e.g., K8S, ECS, S3, docker, server, lambda).


# kosli_flow data source
Source: https://docs.kosli.com/terraform-reference/data-sources/flow

Fetches details of an existing Kosli flow. Use this data source to reference flow configurations and templates.

Fetches details of an existing Kosli flow. A flow represents a business or software process that requires change tracking.

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Query an existing flow
data "kosli_flow" "example" {
  name = "my-application-flow"
}

# Create a new flow reusing the template from an existing one
resource "kosli_flow" "copy" {
  name        = "my-application-flow-copy"
  description = data.kosli_flow.example.description
  template    = data.kosli_flow.example.template
}

output "flow_name" {
  description = "The name of the flow"
  value       = data.kosli_flow.example.name
}

output "flow_template" {
  description = "The YAML template of the flow"
  value       = data.kosli_flow.example.template
}

output "flow_tags" {
  description = "The tags of the flow"
  value       = data.kosli_flow.example.tags
}
```

## Schema

### Required

* `name` (String) The name of the flow to query.

### Read-only

* `description` (String) The description of the flow.
* `tags` (Map of String) Key-value pairs tagging the flow.
* `template` (String) YAML template defining the flow structure (trails, artifacts, attestations).


# kosli_logical_environment data source
Source: https://docs.kosli.com/terraform-reference/data-sources/logical_environment

Fetches details of an existing Kosli logical environment. Use this data source to reference logical environments and access their aggregated physical environments.

Fetches details of an existing Kosli logical environment. Use this data source to reference logical environments and access their aggregated physical environments.

Use this data source to query existing logical environments in Kosli. This is useful for:

* **Referencing metadata**: Access `last_modified_at` timestamps and other computed attributes
* **Cross-stack references**: Reference logical environments created outside Terraform
* **Dynamic configuration**: Use existing logical environment configurations to create variants
* **Validation**: Verify logical environments exist before referencing them
* **Monitoring**: Create conditional logic based on logical environment state

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Query an existing logical environment
data "kosli_logical_environment" "production" {
  name = "production-aggregate"
}

# Use the data source to create a similar logical environment
resource "kosli_logical_environment" "staging" {
  name                  = "staging-aggregate"
  description           = "Staging version of ${data.kosli_logical_environment.production.name}"
  included_environments = data.kosli_logical_environment.production.included_environments
}

# Reference logical environment metadata
output "production_name" {
  description = "Name of the production logical environment"
  value       = data.kosli_logical_environment.production.name
}

output "production_type" {
  description = "Type of the environment (should be 'logical')"
  value       = data.kosli_logical_environment.production.type
}

output "production_description" {
  description = "Description of the production logical environment"
  value       = data.kosli_logical_environment.production.description
}

output "production_environments" {
  description = "List of physical environments included in production aggregate"
  value       = data.kosli_logical_environment.production.included_environments
}

output "production_last_modified" {
  description = "Timestamp of when production logical environment was last modified"
  value       = data.kosli_logical_environment.production.last_modified_at
}

output "production_tags" {
  description = "Tags on the production logical environment"
  value       = data.kosli_logical_environment.production.tags
}

# Count how many environments are aggregated
output "production_environment_count" {
  description = "Number of environments aggregated in production"
  value       = length(data.kosli_logical_environment.production.included_environments)
}

# Conditional logic based on aggregation
locals {
  # Check if logical environment is empty (no included environments)
  is_empty = length(data.kosli_logical_environment.production.included_environments) == 0

  # Check if it includes a specific environment
  includes_k8s = contains(
    data.kosli_logical_environment.production.included_environments,
    "production-k8s"
  )
}

output "production_is_empty" {
  description = "Whether production logical environment has no included environments"
  value       = local.is_empty
}

output "production_includes_k8s" {
  description = "Whether production aggregates a K8S environment"
  value       = local.includes_k8s
}
```

## Type validation

<Note>
  This data source validates that the queried environment is of type `logical`. Attempting to query a physical environment will result in an error. Use the [`kosli_environment` data source](/terraform-reference/data-sources/environment) for physical environments instead.
</Note>

## Use cases

### Reference metadata

Query logical environment metadata for monitoring or conditional logic:

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
data "kosli_logical_environment" "production" {
  name = "production-all"
}

output "production_last_modified" {
  value = data.kosli_logical_environment.production.last_modified_at
}

output "production_environment_count" {
  value = length(data.kosli_logical_environment.production.included_environments)
}
```

### Create variants

Use an existing logical environment as a template for creating similar ones:

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
data "kosli_logical_environment" "production" {
  name = "production-all"
}

resource "kosli_logical_environment" "staging" {
  name        = "staging-all"
  description = "Staging version of ${data.kosli_logical_environment.production.name}"

  # Reuse the same environment structure
  included_environments = data.kosli_logical_environment.production.included_environments
}
```

### Cross-stack references

Reference logical environments created in other Terraform workspaces or outside Terraform:

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
data "kosli_logical_environment" "shared_production" {
  name = "production-all" # Created in infrastructure workspace
}

# Use in application deployment workspace
locals {
  production_environments = data.kosli_logical_environment.shared_production.included_environments
}
```

### Conditional logic

Create conditional logic based on logical environment configuration:

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
data "kosli_logical_environment" "production" {
  name = "production-all"
}

locals {
  # Check if environment is empty
  is_empty = length(data.kosli_logical_environment.production.included_environments) == 0

  # Check if it includes a specific environment
  includes_k8s = contains(
    data.kosli_logical_environment.production.included_environments,
    "production-k8s"
  )
}
```

## Schema

### Required

* `name` (String) The name of the logical environment to query.

### Read-only

* `description` (String) The description of the logical environment.
* `included_environments` (List of String) List of physical environment names aggregated by this logical environment.
* `last_modified_at` (Number) Unix timestamp (with fractional seconds) of when the logical environment was last modified.
* `tags` (Map of String) Key-value pairs tagging the logical environment.
* `type` (String) The environment type (always `logical` for logical environments).


# kosli_policy data source
Source: https://docs.kosli.com/terraform-reference/data-sources/policy

Fetches details of an existing Kosli policy.

Fetches details of an existing Kosli policy.

Use this data source to reference existing policies and access metadata such as the policy content, description, and latest version number.

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Query an existing policy
data "kosli_policy" "production" {
  name = "prod-requirements"
}

output "policy_latest_version" {
  description = "Latest version number of the policy"
  value       = data.kosli_policy.production.latest_version
}

output "policy_content" {
  description = "YAML content of the latest policy version"
  value       = data.kosli_policy.production.content
}
```

## Schema

### Required

* `name` (String) The name of the policy to query.

### Read-only

* `content` (String) YAML content of the latest policy version. Null if the policy has no versions.
* `created_at` (Number) Unix timestamp of when the policy was first created.
* `description` (String) Description of the policy.
* `latest_version` (Number) The version number of the latest policy version. Null if the policy has no versions.


# kosli_service_account data source
Source: https://docs.kosli.com/terraform-reference/data-sources/service_account

Fetches details of an existing Kosli service account. Use this data source to reference service accounts and access metadata such as the privilege, creator, and creation timestamp.

Fetches details of an existing Kosli service account. Use this data source to reference service accounts and access metadata such as the privilege, creator, and creation timestamp.

Use this data source to:

* Reference an existing service account managed outside Terraform
* Read the granted privilege, creating user, and creation timestamp
* Build conditional logic based on service account metadata

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Create a service account
resource "kosli_service_account" "ci" {
  name        = "ci-pipeline"
  description = "CI/CD pipeline service account"
  privilege   = "member"
}

# Look up the service account via data source
data "kosli_service_account" "ci" {
  name = kosli_service_account.ci.name
}

# Reference service account metadata
output "ci_privilege" {
  description = "Privilege (role) of the CI service account"
  value       = data.kosli_service_account.ci.privilege
}

output "ci_created_at" {
  description = "RFC3339 UTC timestamp of when the service account was created"
  value       = data.kosli_service_account.ci.created_at
}
```

## Read-only access

Data sources provide read-only access to service account metadata. To create or modify service accounts, use the [`kosli_service_account` resource](/terraform-reference/resources/service_account). To manage API keys, use the [`kosli_service_account_api_key` resource](/terraform-reference/resources/service_account_api_key).

## Schema

### Required

* `name` (String) The name of the service account to query.

### Read-only

* `created_at` (String) RFC3339 UTC timestamp of when the service account was created.
* `creating_user_id` (String) Identifier of the user who created the service account.
* `description` (String) The description of the service account.
* `display_name` (String) The display name of the service account.
* `for_webhook` (Boolean) Whether the service account was created for webhook usage.
* `privilege` (String) The privilege (role) of the service account within the organization (`admin`, `member`, `snapshotter`, or `reader`).


# Kosli Terraform Provider
Source: https://docs.kosli.com/terraform-reference/index

Manage Kosli resources as Infrastructure-as-Code using Terraform.

The Kosli provider allows you to manage Kosli resources as Infrastructure-as-Code using Terraform. Use it to define and manage environments, policies, actions, custom attestation types, and integrate Kosli into your compliance workflows.

<Note>
  The provider is officially registered at the [Terraform Registry](https://registry.terraform.io/providers/kosli-dev/kosli/latest/docs).
</Note>

## Requirements

* Terraform >= 1.10
* A Kosli account with API credentials

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Configure the Kosli Provider
# Authentication via environment variables (recommended)
provider "kosli" {
  # API token - set via KOSLI_API_TOKEN environment variable
  # Organization name - set via KOSLI_ORG environment variable

  # Optional: API endpoint URL (defaults to https://app.kosli.com)
  # api_url = "https://app.us.kosli.com"  # Use US region

  # Optional: HTTP client timeout in seconds (defaults to 30)
  # timeout = 60
}
```

## Authentication

The provider requires a Kosli API token and organization name for authentication. These can be configured in two ways (in order of precedence):

1. **Provider configuration** - Set directly in your Terraform configuration
2. **Environment variables** - Use `KOSLI_API_TOKEN` and `KOSLI_ORG`

### Creating an API token

To create an API token:

1. Log in to [Kosli](https://app.kosli.com)
2. Navigate to **Settings** → **API Tokens**
3. Click **Create Token**
4. Copy the token and store it securely

<Warning>
  API tokens grant full access to your Kosli organization. Store them securely and never commit them to version control.
</Warning>

## Regional endpoints

Kosli operates in multiple regions. Configure the `api_url` to match your organization's region:

* **EU (Default)**: `https://app.kosli.com`
* **US**: `https://app.us.kosli.com`

## Schema

### Optional

* `api_token` (String, Sensitive) Kosli API token for authentication. Can also be set via KOSLI\_API\_TOKEN environment variable.
* `api_url` (String) Kosli API endpoint URL. Defaults to [https://app.kosli.com](https://app.kosli.com) (EU region). Use [https://app.us.kosli.com](https://app.us.kosli.com) for US region. Can also be set via KOSLI\_API\_URL environment variable.
* `org` (String) Kosli organization name. Can also be set via KOSLI\_ORG environment variable.
* `timeout` (Number) HTTP client timeout in seconds. Defaults to 30 seconds.


# kosli_control list resource
Source: https://docs.kosli.com/terraform-reference/list-resources/control

Lists Kosli controls in the organization for use with terraform query, so existing controls can be discovered and brought under Terraform management without hand-writing one import block per control.

Lists Kosli controls in the organization for use with `terraform query` (requires Terraform >= 1.14), so existing controls can be discovered and brought under Terraform management without hand-writing one `import` block per control.

<Warning>
  Controls is a **beta** feature and must be enabled for your organization; API requests return `403 Forbidden` otherwise.
</Warning>

<Note>
  The Kosli list endpoint does not return `policies_referencing`, so when resource data is included in query results that attribute is always reported as an empty list. Archived controls are only returned when `archived = true` is set.
</Note>

## Example usage

Place `list` blocks in a `.tfquery.hcl` file and run `terraform query` (requires Terraform >= 1.14):

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# List all active controls in the organization
list "kosli_control" "all" {
  provider = kosli
}

# List controls matching a search string, including full resource data
# (e.g. for `terraform query -generate-config-out=generated.tf`)
list "kosli_control" "sdlc" {
  provider         = kosli
  include_resource = true

  config {
    search = "SDLC"
  }
}

# Include archived controls in the results
list "kosli_control" "archived" {
  provider = kosli

  config {
    archived = true
  }
}
```

Use `terraform query -generate-config-out=generated.tf` to generate `import` blocks and resource configuration for the discovered controls. To manage the resulting controls, see the [`kosli_control` resource](/terraform-reference/resources/control).

## Schema

### Optional

* `archived` (Boolean) Include archived controls in the results. Defaults to `false`.
* `search` (String) Case-insensitive substring to match against control names and identifiers.


# kosli_action resource
Source: https://docs.kosli.com/terraform-reference/resources/action

Manages a Kosli action. Actions define webhook notifications triggered by environment compliance events.

Manages a Kosli action. Actions define webhook notifications triggered by environment compliance events.

<Note>
  Actions are identified internally by a server-assigned `number`. The `name` is used during import to look up the number.
</Note>

Use this resource to configure automated notifications when environments change compliance state. Actions send webhooks to external services such as Slack or Microsoft Teams.

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Action that fires on non-compliant environment events
resource "kosli_action" "compliance_alerts" {
  name         = "compliance-alerts"
  environments = ["production-k8s"]
  triggers     = ["ON_NON_COMPLIANT_ENV", "ON_COMPLIANT_ENV"]
  webhook_url  = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXX"
}

# Action that fires on scaling events
resource "kosli_action" "scaling_alerts" {
  name         = "scaling-alerts"
  environments = ["staging-ecs"]
  triggers     = ["ON_SCALED_ARTIFACT"]
  webhook_url  = "https://outlook.office.com/webhook/XXXX"
}
```

## Import

Actions can be imported using their name:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# Import an existing action by name
terraform import kosli_action.compliance_alerts compliance-alerts
```

## Schema

### Required

* `environments` (List of String) List of environment names this action monitors.
* `name` (String) Name of the action. Must be unique within the organization. Changing this will force recreation of the resource.
* `triggers` (List of String) List of trigger event types that activate this action (e.g. `ON_NON_COMPLIANT_ENV`, `ON_COMPLIANT_ENV`).
* `webhook_url` (String, Sensitive) Webhook URL to send notifications to.

### Read-only

* `created_by` (String) User who created the action.
* `last_modified_at` (Number) Unix timestamp of when the action was last modified.
* `number` (Number) Server-assigned numeric identifier for the action.


# kosli_control resource
Source: https://docs.kosli.com/terraform-reference/resources/control

Manages a Kosli control. Controls are org-level definitions of SDLC requirements whose compliance is evaluated from attestations and enforced through environment policies.

Manages a Kosli control. Controls are org-level definitions of SDLC requirements (for example `SDLC-001` "Binary provenance") whose compliance is evaluated from attestations and enforced through environment policies.

<Warning>
  Controls is a **beta** feature and must be enabled for your organization; API requests return `403 Forbidden` otherwise.
</Warning>

<Note>
  Deleting this resource **archives** the control in Kosli rather than hard-deleting it. Creating a new control with the identifier of an archived control fails with a conflict; unarchive the control in Kosli and import it instead.
</Note>

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Control requiring binary provenance for production artifacts
resource "kosli_control" "binary_provenance" {
  identifier  = "SDLC-001"
  name        = "Binary provenance"
  description = "All production artifacts must have build provenance attestations"

  links = {
    docs = "https://example.com/sdlc/binary-provenance"
  }

  tags = {
    framework = "finos-sdlc"
    team      = "platform"
  }
}

# Minimal control with only the required attributes
resource "kosli_control" "peer_review" {
  identifier = "SDLC-002"
  name       = "Peer review"
}
```

## Import

Controls can be imported using their identifier:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# Import an existing control by identifier
terraform import kosli_control.binary_provenance SDLC-001
```

## Querying controls

To reference an existing control and access metadata such as the current version, tags, and referencing policies, use the [`kosli_control` data source](/terraform-reference/data-sources/control).

## Schema

### Required

* `identifier` (String) Unique identifier of the control within the organization (e.g. `SDLC-001`). Must start with a letter or number and contain only letters, numbers, periods (`.`), hyphens (`-`), underscores (`_`), and tildes (`~`). Changing this will force recreation of the resource.
* `name` (String) Human-readable display name of the control (e.g. `Binary provenance`). Can be changed without recreating the control.

### Optional

* `description` (String) Free-form description of the control.
* `links` (Map of String) Named links related to the control (e.g. documentation or runbook URLs), as a map of link name to URL.
* `tags` (Map of String) Key-value pairs to tag the control.

### Read-only

* `created_at` (String) RFC3339 UTC timestamp of when the control was created.
* `created_by` (String) Identifier of the user who created the control.
* `policies_referencing` (List of String) Names of the environment policies that reference this control.
* `version` (Number) Version number of the control, assigned by the server and incremented on every update.


# kosli_custom_attestation_type resource
Source: https://docs.kosli.com/terraform-reference/resources/custom_attestation_type

Manages a custom attestation type in Kosli. Custom attestation types define how Kosli validates and evaluates evidence from proprietary tools, custom metrics, or specialized compliance requirements.

Manages a custom attestation type in Kosli. Custom attestation types define how Kosli validates and evaluates evidence from proprietary tools, custom metrics, or specialized compliance requirements.

Custom attestation types define the structure and validation rules for attestations in Kosli. They can include:

* A JSON Schema (optional) that defines the expected structure of attestation data
* JQ rules (optional) that evaluate the attestation data for compliance

**Note**: While both `schema` and `jq_rules` are optional attributes in Terraform, the Kosli API requires at least one of them to be provided when creating or updating a custom attestation type.

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Security scan attestation type
resource "kosli_custom_attestation_type" "security_scan" {
  name        = "security-scan"
  description = "Validates security scan results"

  schema = jsonencode({
    type = "object"
    properties = {
      critical_vulnerabilities = { type = "integer" }
      high_vulnerabilities     = { type = "integer" }
      medium_vulnerabilities   = { type = "integer" }
      scan_date                = { type = "string" }
      scanner_version          = { type = "string" }
      report_url               = { type = "string" }
    }
    required = ["critical_vulnerabilities", "high_vulnerabilities", "scan_date"]
  })

  jq_rules = [
    ".critical_vulnerabilities == 0",
    ".high_vulnerabilities < 5"
  ]

  # Ordered, labelled values shown on the attestation detail page in Kosli.
  # A value that is a valid URL renders as a clickable link.
  summary = jsonencode([
    { name = "Critical", expression = ".critical_vulnerabilities" },
    { name = "High", expression = ".high_vulnerabilities" },
    { name = "Scanner", expression = ".scanner_version" },
    { name = "Report", expression = ".report_url" },
  ])
}

# Code coverage attestation type
resource "kosli_custom_attestation_type" "code_coverage" {
  name        = "code-coverage"
  description = "Validates code coverage metrics"

  schema = jsonencode({
    type = "object"
    properties = {
      line_coverage = {
        type    = "number"
        minimum = 0
        maximum = 100
      }
      branch_coverage = {
        type    = "number"
        minimum = 0
        maximum = 100
      }
      total_lines   = { type = "integer" }
      covered_lines = { type = "integer" }
    }
    required = ["line_coverage", "total_lines", "covered_lines"]
  })

  jq_rules = [
    ".line_coverage >= 80",
    ".branch_coverage >= 70"
  ]
}

# Attestation type whose schema and summary are kept in standalone JSON files,
# so the same definitions can be shared with other tooling
resource "kosli_custom_attestation_type" "code_quality" {
  name        = "code-quality"
  description = "Validates code quality metrics"

  schema  = file("${path.module}/schemas/code-quality.json")
  summary = file("${path.module}/summaries/code-quality.json")

  jq_rules = [
    ".line_coverage >= 80",
    ".lint_errors == 0"
  ]
}

# Age verification attestation type with only jq rules (no schema)
resource "kosli_custom_attestation_type" "age_verification" {
  name        = "age-verification"
  description = "Verifies age is over 21 using only jq rules without schema validation"

  jq_rules = [".age > 21"]
}

# Schema-only attestation type (no jq rules)
resource "kosli_custom_attestation_type" "schema_validation" {
  name        = "data-structure-validation"
  description = "Validates data structure using schema without evaluation rules"

  schema = jsonencode({
    type = "object"
    properties = {
      timestamp = { type = "string" }
      metadata  = { type = "object" }
      status    = {
        type = "string"
        enum = ["pass", "fail", "skip"]
      }
    }
    required = ["timestamp", "status"]
  })
}
```

## Schema validation

The `schema` attribute is optional and can contain a valid JSON Schema (draft-07) that defines the structure of attestation data. When provided, attestation data will be validated against this schema. Common schema types:

* **Security scans**: Define vulnerability counts and scan metadata
* **Code coverage**: Define coverage percentages and test metrics
* **Performance tests**: Define response times and error rates

### Schema example

```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
{
  "type": "object",
  "properties": {
    "critical_vulnerabilities": { "type": "integer" },
    "high_vulnerabilities": { "type": "integer" },
    "scan_date": { "type": "string" }
  },
  "required": ["critical_vulnerabilities", "high_vulnerabilities", "scan_date"]
}
```

## JQ rules

The `jq_rules` attribute is optional and contains an array of JQ expressions that must ALL evaluate to `true` for an attestation to be considered compliant. When provided, each rule is evaluated against the attestation data. If omitted, no evaluation is performed.

### JQ rules examples

```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
jq_rules = [
  ".critical_vulnerabilities == 0",     # No critical vulnerabilities allowed
  ".high_vulnerabilities < 5",          # Less than 5 high vulnerabilities
  ".scan_date != null"                  # Scan date must be present
]
```

## Import

Custom attestation types can be imported using their name:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# Import an existing custom attestation type by name
terraform import kosli_custom_attestation_type.security_scan security-scan
```

## Schema

### Required

* `name` (String) Name of the custom attestation type. Must start with a letter or number and can only contain letters, numbers, periods, hyphens, underscores, and tildes. Changing this will force recreation of the resource.

### Optional

* `description` (String) Description of the custom attestation type. Explains what this attestation type validates.
* `jq_rules` (List of String) List of jq evaluation rules. Each rule is a jq expression that must evaluate to true for the attestation to be considered compliant. Example: `[".coverage >= 80"]`. If omitted, no evaluation is performed.
* `schema` (String) JSON Schema definition that defines the structure of attestation data. Can be provided inline using heredoc syntax or loaded from a file using `file()`. If omitted, no schema validation is performed. Semantic equality is used for comparison, so formatting differences are ignored.
* `summary` (String) JSON array of ordered, labelled jq expressions rendered as rows on the attestation detail page in Kosli. Each element is an object with a `name` (the row label) and an `expression` (a jq expression evaluated against the attestation data); values that are valid URLs render as links. Can be provided inline using `jsonencode()`/heredoc syntax or loaded from a file using `file()`, so the same JSON can be kept in one place and shared with other tooling. Example: `jsonencode([{ name = "Coverage", expression = ".coverage" }])`. If omitted, the attestation detail page falls back to showing the jq evaluation results as a pass/fail checklist; removing it from a type that had one clears the summary. Semantic JSON equality is used when reading the value back from Kosli, so your formatting is preserved rather than being rewritten to the API's compact form.


# kosli_environment resource
Source: https://docs.kosli.com/terraform-reference/resources/environment

Manages a Kosli environment. Environments represent deployment targets where artifacts are deployed. Supports physical environment types: K8S, ECS, S3, docker, server, and lambda.

Manages a Kosli environment. Environments represent deployment targets where artifacts are deployed. Supports physical environment types: K8S, ECS, S3, docker, server, and lambda.

<Warning>
  This resource manages the environment configuration and tags. To attach compliance policies, use the [`kosli_policy_attachment` resource](/terraform-reference/resources/policy_attachment). For querying environment metadata such as `last_modified_at`, `last_reported_at`, and `archived` status, use the [`kosli_environment` data source](/terraform-reference/data-sources/environment).
</Warning>

Kosli environments track deployments and provide visibility into what's running in your infrastructure. Physical environments represent actual runtime locations such as:

* **K8S**: Kubernetes clusters
* **ECS**: Amazon Elastic Container Service clusters
* **S3**: Amazon S3 buckets
* **docker**: Docker containers
* **server**: Bare-metal or VM servers
* **lambda**: AWS Lambda functions

<Note>
  For aggregating multiple physical environments into logical groups, use the [`kosli_logical_environment` resource](/terraform-reference/resources/logical_environment).
</Note>

<Note>
  To attach compliance policies to environments, use the [`kosli_policy_attachment` resource](/terraform-reference/resources/policy_attachment).
</Note>

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Basic K8S environment
resource "kosli_environment" "production_k8s" {
  name        = "production-k8s"
  type        = "K8S"
  description = "Production Kubernetes cluster"
}

# K8S environment with tags
resource "kosli_environment" "tagged" {
  name        = "production-k8s-tagged"
  type        = "K8S"
  description = "Production cluster managed by Terraform"
  tags = {
    managed-by  = "terraform"
    environment = "production"
    team        = "platform"
  }
}

# ECS environment
resource "kosli_environment" "staging_ecs" {
  name        = "staging-ecs"
  type        = "ECS"
  description = "Staging ECS cluster"
}

# S3 environment
resource "kosli_environment" "data_lake" {
  name        = "data-lake-s3"
  type        = "S3"
  description = "Data lake S3 bucket environment"
}

# Docker environment
resource "kosli_environment" "local_docker" {
  name = "local-docker"
  type = "docker"
}

# Server environment
resource "kosli_environment" "production_servers" {
  name        = "production-servers"
  type        = "server"
  description = "Production bare-metal servers"
}

# Lambda environment
resource "kosli_environment" "serverless_functions" {
  name        = "serverless-lambda"
  type        = "lambda"
  description = "AWS Lambda functions"
}
```

## Environment types

The `type` attribute must be one of the following physical environment types:

* `K8S` - Kubernetes clusters
* `ECS` - Amazon Elastic Container Service
* `S3` - Amazon S3 buckets
* `docker` - Docker containers
* `server` - Bare-metal or VM servers
* `lambda` - AWS Lambda functions

## Import

Environments can be imported using their name:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
#!/bin/bash

# Import an existing environment by name
terraform import kosli_environment.production_k8s production-k8s

# Import multiple environments
terraform import kosli_environment.staging_ecs staging-ecs
terraform import kosli_environment.data_lake data-lake-s3
```

## Monitoring environments

For querying environment metadata such as `last_modified_at` and `last_reported_at` timestamps, use the [`kosli_environment` data source](/terraform-reference/data-sources/environment). This is useful for monitoring and creating conditional logic based on environment state.

## Schema

### Required

* `name` (String) Name of the environment. Must be unique within the organization. Changing this will force recreation of the resource.
* `type` (String) Type of the environment. Valid values: `K8S`, `ECS`, `S3`, `docker`, `server`, `lambda`. Changing this will force recreation of the resource.

### Optional

* `description` (String) Description of the environment. Explains the purpose and characteristics of this deployment target.
* `tags` (Map of String) Key-value pairs to tag the environment. Tags are applied via a diff — only changed tags are sent to the API. An empty map (`tags = {}`) removes all tags.


# kosli_flow resource
Source: https://docs.kosli.com/terraform-reference/resources/flow

Manages a Kosli flow. Flows represent business or software processes that require change tracking.

Manages a Kosli flow. A flow represents a business or software process that requires change tracking. It lets you monitor changes across all steps within a process or focus on a subset of critical steps.

<Note>
  The `template` attribute accepts a YAML string defining the flow template structure. You can load it from a file using the `file()` function: `template = file("template.yml")`. Minor YAML formatting differences between what you provide and what the API returns may result in a no-op change being shown in plans.
</Note>

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Minimal flow with only a name
resource "kosli_flow" "minimal" {
  name = "my-service"
}

# Flow with description
resource "kosli_flow" "with_description" {
  name        = "api-service"
  description = "CD pipeline for the API service"
}

# Flow with tags
resource "kosli_flow" "tagged" {
  name        = "api-service-tagged"
  description = "API service CD pipeline managed by Terraform"
  tags = {
    managed-by  = "terraform"
    team        = "platform"
    environment = "production"
  }
}

# Flow with a YAML template defining trails and attestations
# The template can also be loaded from a file: template = file("template.yml")
resource "kosli_flow" "with_template" {
  name        = "backend-service"
  description = "Backend service CD pipeline with full attestation template"

  template = <<-YAML
version: 1
trail:
  attestations:
    - name: pull-request
      type: pull_request
    - name: unit-tests
      type: generic
  artifacts:
    - name: docker-image
      attestations:
        - name: sbom
          type: generic
        - name: security-scan
          type: snyk
YAML
}
```

## Import

Flows can be imported using their name:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform import kosli_flow.example my-flow-name
```

## Schema

### Required

* `name` (String) Name of the flow. Must be unique within the organization. Changing this will force recreation of the resource.

### Optional

* `description` (String) Description of the flow. Explains the purpose and context of this pipeline.
* `tags` (Map of String) Key-value pairs to tag the flow. Tags are applied via a diff — only changed tags are sent to the API. An empty map (`tags = {}`) removes all tags.
* `template` (String) YAML template defining the flow structure (trails, artifacts, attestations). Can be provided as an inline heredoc or loaded from a file using `file()`. If omitted, the flow is created without a template.


# kosli_logical_environment resource
Source: https://docs.kosli.com/terraform-reference/resources/logical_environment

Manages a Kosli logical environment. Logical environments aggregate multiple physical environments for organizational purposes.

Manages a Kosli logical environment. Logical environments aggregate multiple physical environments for organizational purposes.

<Warning>
  Logical environments can ONLY contain physical environments (K8S, ECS, S3, docker, server, lambda), not other logical environments. Attempting to include a logical environment will result in an error from the Kosli API.
</Warning>

<Warning>
  This resource manages logical environment configuration and tags. For querying environment metadata such as `last_modified_at` and `archived` status, use the [`kosli_logical_environment` data source](/terraform-reference/data-sources/logical_environment).
</Warning>

Logical environments in Kosli aggregate multiple physical environments for organizational purposes, providing:

* **Unified visibility**: View compliance status across multiple environments at once
* **Flexible grouping**: Organize environments by region, service type, tier, or team
* **Simplified reporting**: Generate compliance reports for logical groupings
* **Team organization**: Allow different teams to focus on specific environment groups

## Physical environments only

<Warning>
  Logical environments can ONLY contain physical environments (K8S, ECS, S3, docker, server, lambda), not other logical environments. Attempting to include a logical environment will result in an API error.
</Warning>

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# First, create physical environments that will be aggregated
resource "kosli_environment" "production_k8s" {
  name        = "production-k8s"
  type        = "K8S"
  description = "Production Kubernetes cluster"
}

resource "kosli_environment" "production_ecs" {
  name        = "production-ecs"
  type        = "ECS"
  description = "Production ECS cluster"
}

resource "kosli_environment" "production_lambda" {
  name        = "production-lambda"
  type        = "lambda"
  description = "Production Lambda functions"
}

# Basic logical environment aggregating production environments
resource "kosli_logical_environment" "production_all" {
  name        = "production-aggregate"
  description = "Aggregates all production environments for unified visibility"

  included_environments = [
    kosli_environment.production_k8s.name,
    kosli_environment.production_ecs.name,
    kosli_environment.production_lambda.name,
  ]
}

# Logical environment with just two environments
resource "kosli_logical_environment" "cloud_services" {
  name        = "cloud-services"
  description = "All cloud-based services"

  included_environments = [
    kosli_environment.production_ecs.name,
    kosli_environment.production_lambda.name,
  ]
}

# Minimal logical environment with empty list (can be populated later)
resource "kosli_logical_environment" "future_environments" {
  name                  = "future-environments"
  included_environments = []
}

# Logical environment with tags
resource "kosli_logical_environment" "tagged" {
  name        = "production-tagged"
  description = "Tagged production logical environment"

  included_environments = [
    kosli_environment.production_k8s.name,
    kosli_environment.production_ecs.name,
  ]

  tags = {
    managed-by  = "terraform"
    environment = "production"
    team        = "platform"
  }
}

# Logical environment without description (optional)
resource "kosli_logical_environment" "simple" {
  name = "simple-aggregate"

  included_environments = [
    kosli_environment.production_k8s.name,
  ]
}
```

## Complete example

For a comprehensive example showing logical environments aggregating physical environments by region, service type, and tier, see the [complete logical environments example](https://github.com/kosli-dev/terraform-provider-kosli/tree/main/examples/complete/logical-environments).

## Common use cases

### By environment tier

Aggregate all production or staging environments for unified compliance reporting:

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
resource "kosli_logical_environment" "production_all" {
  name        = "production-all"
  description = "All production environments"

  included_environments = [
    kosli_environment.prod_k8s.name,
    kosli_environment.prod_ecs.name,
    kosli_environment.prod_lambda.name,
  ]
}
```

### By geographic region

Group environments by region for regional compliance or disaster recovery:

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
resource "kosli_logical_environment" "production_us_east" {
  name        = "production-us-east"
  description = "All production environments in US East"

  included_environments = [
    kosli_environment.prod_k8s_us_east.name,
    kosli_environment.prod_ecs_us_east.name,
  ]
}
```

### By service type

Organize environments by technology stack or service type:

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
resource "kosli_logical_environment" "all_kubernetes" {
  name        = "all-kubernetes-clusters"
  description = "All Kubernetes clusters across regions"

  included_environments = [
    kosli_environment.k8s_us_east.name,
    kosli_environment.k8s_eu_west.name,
    kosli_environment.k8s_ap_south.name,
  ]
}
```

## Empty logical environments

Logical environments can be created with empty `included_environments` lists and populated later:

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
resource "kosli_logical_environment" "future_environments" {
  name                  = "planned-expansion"
  description           = "Placeholder for future environments"
  included_environments = []
}
```

## Import

Logical environments can be imported using their name:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
#!/bin/bash

# Import an existing logical environment by name
terraform import kosli_logical_environment.production_all production-aggregate

# Import multiple logical environments
terraform import kosli_logical_environment.cloud_services cloud-services
terraform import kosli_logical_environment.future_environments future-environments
```

## Querying metadata

## Schema

### Required

* `included_environments` (List of String) List of physical environment names to aggregate. Only physical environments are allowed (K8S, ECS, S3, docker, server, lambda). Can be empty.
* `name` (String) Name of the logical environment. Must be unique within the organization. Changing this will force recreation of the resource.

### Optional

* `description` (String) Description of the logical environment. Explains the purpose and aggregation strategy.
* `tags` (Map of String) Key-value pairs to tag the logical environment. Tags are applied via a diff — only changed tags are sent to the API. An empty map (`tags = {}`) removes all tags.

### Read-only

* `type` (String) Type of the environment. Always set to `logical` (computed by provider, not user-configurable).


# kosli_policy resource
Source: https://docs.kosli.com/terraform-reference/resources/policy

Manages a Kosli policy. Policies define artifact compliance requirements that can be attached to environments.

Manages a Kosli policy. Policies define artifact compliance requirements (provenance, trail-compliance, attestations) that can be attached to environments.

Policies are versioned and immutable: updating `content` or `description` creates a new version rather than modifying the existing one.

<Warning>
  Deleting this resource removes it from Terraform state only. Kosli has no API endpoint to delete policies, so the policy will remain in Kosli after `terraform destroy`. To attach policies to environments, use the [`kosli_policy_attachment` resource](/terraform-reference/resources/policy_attachment).
</Warning>

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Minimal policy requiring provenance for all artifacts
resource "kosli_policy" "minimal" {
  name = "basic-requirements"
  content = <<-YAML
    _schema: https://docs.kosli.com/schemas/policy/v1
    artifacts:
      provenance:
        required: true
  YAML
}

# Production policy with full compliance requirements
resource "kosli_policy" "production" {
  name        = "prod-requirements"
  description = "Compliance requirements for production environments"
  content     = <<-YAML
    _schema: https://docs.kosli.com/schemas/policy/v1
    artifacts:
      provenance:
        required: true
      trail-compliance:
        required: true
      attestations:
        - name: unit-test
          type: junit
        - name: dependency-scan
          type: "*"
  YAML
}
```

## Import

Policies can be imported using their name:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# Import a policy by name. The content attribute is populated from the API response.
terraform import kosli_policy.example prod-requirements
```

## Schema

### Required

* `content` (String) YAML content of the policy, conforming to the Kosli policy schema (`_schema: https://docs.kosli.com/schemas/policy/v1`). Supports heredoc syntax for multi-line YAML. Updating this value creates a new policy version.
* `name` (String) Name of the policy. Must be unique within the organization. Changing this will force recreation of the resource.

### Optional

* `description` (String) Description of the policy.

### Read-only

* `created_at` (Number) Unix timestamp of when the policy was first created.
* `latest_version` (Number) The version number of the latest policy version. Null if the policy has no versions.


# kosli_policy_attachment resource
Source: https://docs.kosli.com/terraform-reference/resources/policy_attachment

Attaches a Kosli policy to an environment. When this resource is destroyed, the policy is detached from the environment.

Attaches a Kosli policy to an environment (physical or logical). When this resource is destroyed, the policy is detached from the environment.

Both `environment_name` and `policy_name` are immutable: changing either attribute will destroy the existing attachment and create a new one.

<Note>
  Both the policy and environment must exist before creating an attachment. Use the [`kosli_policy` resource](/terraform-reference/resources/policy) and [`kosli_environment` resource](/terraform-reference/resources/environment) to manage them.
</Note>

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Attach a policy to an environment.
# Both the policy and environment must exist before creating the attachment.
resource "kosli_policy_attachment" "example" {
  environment_name = "my-environment"
  policy_name      = "my-policy"
}
```

## Import

Policy attachments can be imported using the composite ID `environment_name/policy_name`:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# Import a policy attachment using the composite ID: environment_name/policy_name
terraform import kosli_policy_attachment.example my-environment/my-policy
```

## Schema

### Required

* `environment_name` (String) Name of the environment to attach the policy to. Changing this will force recreation of the resource.
* `policy_name` (String) Name of the policy to attach. Changing this will force recreation of the resource.


# kosli_service_account resource
Source: https://docs.kosli.com/terraform-reference/resources/service_account

Manages a Kosli service account. Service accounts are non-human identities used to authenticate automation (such as CI/CD pipelines) against the Kosli API.

Manages a Kosli service account. Service accounts are non-human identities used to authenticate automation (such as CI/CD pipelines) against the Kosli API. API keys for a service account are managed separately via the [`kosli_service_account_api_key` resource](/terraform-reference/resources/service_account_api_key).

<Note>
  Service accounts cannot be created in personal organizations. Only organization admins or the user who created the service account can manage it.
</Note>

Use this resource to manage the lifecycle of a service account. To mint API keys, use the [`kosli_service_account_api_key` resource](/terraform-reference/resources/service_account_api_key). To look up an existing service account's metadata, use the [`kosli_service_account` data source](/terraform-reference/data-sources/service_account).

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Service account for a CI/CD pipeline
resource "kosli_service_account" "ci" {
  name        = "ci-pipeline"
  description = "CI/CD pipeline service account"
  privilege   = "member"
}

# Read-only service account (e.g. for dashboards)
resource "kosli_service_account" "dashboard" {
  name      = "dashboard-readonly"
  privilege = "reader"
}
```

## Privileges

The `privilege` attribute must be one of the following:

* `admin` — Full administrative access
* `member` — Standard read/write access
* `snapshotter` — May report environment snapshots
* `reader` — Read-only access

You can only create a service account with a privilege equal to or lower than your own.

## Import

Service accounts can be imported using their name:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# Import an existing service account by name
terraform import kosli_service_account.ci ci-pipeline
```

## Managing API keys

To mint API keys for a service account, use the [`kosli_service_account_api_key` resource](/terraform-reference/resources/service_account_api_key). To look up an existing service account's metadata, use the [`kosli_service_account` data source](/terraform-reference/data-sources/service_account).

## Schema

### Required

* `name` (String) Name of the service account. Must be unique within the organization, contain only alphanumeric characters and hyphens (`^[a-zA-Z0-9\-]+$`), and be at most 64 characters. Changing this will force recreation of the resource.
* `privilege` (String) Privilege (role) granted to the service account within the organization. Valid values: `admin`, `member`, `snapshotter`, `reader`. You can only create a service account with a privilege equal to or lower than your own.

### Optional

* `description` (String) Free-form description of the service account.

### Read-only

* `created_at` (String) RFC3339 UTC timestamp of when the service account was created.
* `creating_user_id` (String) Identifier of the user who created the service account.
* `display_name` (String) Display name of the service account, assigned by the server.
* `for_webhook` (Boolean) Whether the service account was created for webhook usage.


# kosli_service_account_api_key resource
Source: https://docs.kosli.com/terraform-reference/resources/service_account_api_key

Manages an API key for a Kosli service account. The raw key value is returned only once, at creation time, and is stored in Terraform state as a sensitive value.

Manages an API key for a Kosli service account. API keys authenticate a service account against the Kosli API. Use this resource to mint and revoke keys for a service account managed with the [`kosli_service_account` resource](/terraform-reference/resources/service_account).

<Warning>
  The raw `key` value is returned **only once**, at creation time, and is stored in Terraform state as a sensitive value. It is SHA-256 hashed server-side and can never be retrieved again — protect your Terraform state accordingly.
</Warning>

<Note>
  API keys are immutable. Changing `description`, `expires_at`, or `service_account_name` revokes the existing key and creates a new one. On `terraform import`, the `key` attribute cannot be populated because the raw value is not retrievable.
</Note>

## Example usage

```terraform theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform {
  required_providers {
    kosli = {
      source = "kosli-dev/kosli"
    }
  }
}

# Service account that the API key belongs to
resource "kosli_service_account" "ci" {
  name        = "ci-pipeline"
  description = "CI/CD pipeline service account"
  privilege   = "member"
}

# A non-expiring API key
resource "kosli_service_account_api_key" "ci_key" {
  service_account_name = kosli_service_account.ci.name
  description          = "Production CI key"
}

# An API key that expires (RFC3339 timestamp)
resource "kosli_service_account_api_key" "ci_key_expiring" {
  service_account_name = kosli_service_account.ci.name
  description          = "Temporary CI key"
  expires_at           = "2100-01-01T00:00:00Z"
}

# The raw key is only available on creation and is sensitive
output "ci_api_key" {
  value     = kosli_service_account_api_key.ci_key.key
  sensitive = true
}
```

## Expiry

The `expires_at` attribute is an RFC3339 timestamp, e.g. `2100-01-01T00:00:00Z` (offsets such as `+01:00` are accepted and normalized to UTC). Omit it for a key that never expires. The timestamp must not be in the past.

To derive dates dynamically, use Terraform's built-in functions, e.g. `timeadd("2026-01-01T00:00:00Z", "8760h")`.

<Note>
  All timestamps (`expires_at`, `created_at`, `last_used_at`) are RFC3339 UTC strings. `last_used_at` is null for a key that has never been used; `expires_at` is null for a key that never expires.
</Note>

## Import

API keys can be imported using the `<service_account_name>/<key_id>` format:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# Import an existing API key using the "<service_account_name>/<key_id>" format.
# Note: the raw key value cannot be recovered on import (it is only returned once
# at creation), so the "key" attribute will be empty after import.
terraform import kosli_service_account_api_key.ci_key ci-pipeline/01HXYZ0123456789ABCDEFGHIJ
```

Because the raw key value is only returned at creation time, the `key` attribute is empty after an import.

## Schema

### Required

* `description` (String) Description of the API key (at least one character). Changing this forces creation of a new key.
* `service_account_name` (String) Name of the service account this API key belongs to. Changing this forces creation of a new key.

### Optional

* `expires_at` (String) RFC3339 timestamp at which the key expires, e.g. `2100-01-01T00:00:00Z` (offsets allowed; whole seconds only). Omit for a key that never expires. Must not be in the past (validated server-side at apply time). Changing this forces creation of a new key. Removing a previously set value from configuration leaves the existing expiry unchanged; to get a non-expiring key again, the key must be recreated (e.g. via `terraform taint` or by changing another argument).

### Read-only

* `created_at` (String) RFC3339 UTC timestamp of when the API key was created.
* `id` (String) Server-assigned identifier of the API key.
* `key` (String, Sensitive) The raw API key value. Only available at creation time and stored as a sensitive value. Empty when the resource is imported.
* `last_used_at` (String) RFC3339 UTC timestamp of when the API key was last used. Null if the key has never been used.


# Docker API version error in GitHub Actions
Source: https://docs.kosli.com/troubleshooting/docker_api_version_error

How to fix the "client version 1.51 is too new" error when running the Kosli CLI with Docker operations.

## Error

```
Error response from daemon: client version 1.47 is too new. Maximum supported API version is 1.45
```

<Info>
  **Kosli CLI v2.15.1+:** This error is resolved automatically. The CLI now negotiates the Docker API version with the daemon, so it adapts to whatever Docker Engine version is available. Upgrade to v2.15.1 or later and no workaround is needed.
</Info>

## Solution for CLI versions before v2.15.1

Set the `DOCKER_API_VERSION` environment variable in your workflow:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
env:
  DOCKER_API_VERSION: "1.45"
```

## Context

Prior to v2.15.1, the Kosli CLI defaulted to a fixed Docker API version (e.g., 1.47), which could be higher than what the Docker daemon on the host supports. This caused Docker operations (`--artifact-type docker`) to fail with a "client version is too new" error.

From v2.15.1 onwards, the CLI automatically negotiates the API version with the Docker daemon, eliminating this issue.


# GitHub can't see KOSLI_API_TOKEN secret
Source: https://docs.kosli.com/troubleshooting/github_kosli_api_token

How to make the KOSLI_API_TOKEN secret available in GitHub Actions workflows.

## Error

Kosli CLI commands fail in GitHub Actions because `KOSLI_API_TOKEN` is not set, even though the secret exists in your repository.

## Solution

Add the secret to your workflow's environment variables explicitly:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
env:
  KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
```

## Context

Secrets in GitHub Actions are not automatically exported as environment variables. You must map them explicitly in each workflow or job.


# Repo digest unavailable
Source: https://docs.kosli.com/troubleshooting/repo_digest_unavailable

How to fix the "repo digest unavailable for the image" error when running kosli attest artifact with --artifact-type=docker.

## Error

```
Error: repo digest unavailable for the image, has it been pushed to or pulled from a registry?
```

## Why this happens

When `kosli attest artifact` is called with `--artifact-type=docker`, Kosli asks the local Docker daemon for the image's **repo digest** (the SHA256 of the image manifest in a registry). A repo digest is only attached to an image once it has been pushed to or pulled from a registry. A freshly built image (just `docker build`) has an image ID, but no repo digest, and Kosli will refuse to attest it.

This often surfaces in CI even when the same command appears to work locally. Locally, the image may have been pushed or pulled at some earlier point and the digest is cached on the machine. On a fresh CI runner, the image is only ever built, so the digest is genuinely missing.

You can confirm the difference with:

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
docker inspect --format '{{json .RepoDigests}}' <image>
```

A built-but-never-pushed image returns `[]`. An image pulled from or pushed to a registry returns one or more digest entries.

## Solutions

Pick whichever fits your pipeline best.

### Push the image first, then attest

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
docker push <registry>/<image>:<tag>
kosli attest artifact <registry>/<image>:<tag> --artifact-type=docker ...
```

This is the most direct fix and produces an attestation tied to the registry digest.

### Use `--artifact-type=oci`

If the image is already in a registry, `oci` fetches the digest directly via the registry API and does not require a local Docker daemon at all:

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest artifact <registry>/<image>:<tag> \
  --artifact-type=oci \
  --registry-username=$REGISTRY_USER \
  --registry-password=$REGISTRY_TOKEN \
  ...
```

### Provide the fingerprint directly

If you have already computed a fingerprint elsewhere in your pipeline, pass it with `--fingerprint` and drop `--artifact-type` entirely. The fingerprint must still match what runtime reporters will see for the artifact in your environments, so it should normally be the registry digest.


# CLI in subshell captures stderr
Source: https://docs.kosli.com/troubleshooting/subshell_stderr

How to handle Kosli CLI debug output being captured in subshell variables in CI workflows.

## Error

When capturing Kosli CLI output in a subshell variable in CI, the variable contains debug output mixed with the expected value:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
DIGEST="$(kosli fingerprint "${IMAGE_NAME}" --artifact-type=docker)"

echo "DIGEST=${DIGEST}"
DIGEST=[debug] calculated fingerprint: 2c6079df5829...
2c6079df58292ed10e8074adcb74be549b7f841a1bd8266f06bb5c518643193e
```

## Solution

Explicitly set `--debug=false` when running Kosli CLI commands in a subshell:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
DIGEST="$(kosli fingerprint "${IMAGE_NAME}" --artifact-type=docker --debug=false)"
```

## Context

The Kosli CLI writes debug information to `stderr` and all other output to `stdout`. In a local terminal, a `$(subshell)` captures only `stdout`. However, in many CI workflows (including GitHub and GitLab), `stdout` and `stderr` are multiplexed together, causing debug output to leak into captured variables.

## See also

* [Output and verbosity](/client_reference/output_and_verbosity) — full reference for the CLI's stdout/stderr behavior, `[warning]` messages, and the `--quiet` and `--debug` flags.


# What do I do if Kosli is down?
Source: https://docs.kosli.com/troubleshooting/what_do_i_do_if_kosli_is_down

This page shows you how to bypass Kosli attestations if Kosli is down so your CI pipelines keep running, and how to re-enable them when it recovers.

## Status of Kosli services <iframe />

<script type="text/javascript" />

You can also check the current status of Kosli services by running `kosli status` in the CLI.

## Turning Kosli CLI calls on and off instantly

If the `KOSLI_DRY_RUN` environment variable is set to `true` then all Kosli CLI commands will:

* Not communicate with Kosli at all
* Print the payload they would have sent
* Exit with a zero status code

We recommend creating an Org-level KOSLI\_DRY\_RUN variable in your CI system and, in all CI workflows,
ensuring there is an environment variable set from it.

For example, in a [Github Action workflow](https://github.com/cyber-dojo/differ/blob/main/.github/workflows/main.yml):

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
name: Main
...
env:
  KOSLI_DRY_RUN: ${{ vars.KOSLI_DRY_RUN }}           # true iff Kosli is down
```

## Turning Kosli API calls on and off instantly

If you are using the Kosli API in your workflows (e.g. using `curl`), we recommend using the same Org-level `KOSLI_DRY_RUN`
environment variable and guarding the `curl` call with a simple if statement. For example:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
#!/usr/bin/env bash

kosli_curl()
{
  local URL="${1}"
  local JSON_PAYLOAD="${2}"

  if [ "${KOSLI_DRY_RUN:-}" == "true" ]; then
    echo KOSLI_DRY_RUN is set to true. This is the payload that would have been sent
    echo "${JSON_PAYLOAD}" | jq .
  else
    curl ... --data="${JSON_PAYLOAD}" "${URL}"
  fi
}
```


# Path/Image name is a single whitespace character
Source: https://docs.kosli.com/troubleshooting/whitespace_path

How to fix the whitespace path error when using multi-line Kosli CLI commands.

## Error

```
Error: failed to calculate artifact fingerprint: stat  : no such file or directory. The directory path is ' '.
```

## Solution

Check your multi-line command for extraneous whitespace after line-continuation backslashes (`\`). Remove any spaces or tabs after the `\` on each line.

## Context

When using multi-line commands, whitespace added after a line-continuation backslash is interpreted as the artifact path or image name argument.


# zsh: no such user or named directory
Source: https://docs.kosli.com/troubleshooting/zsh_no_such_user

How to fix the zsh error when using arguments starting with ~ in Kosli CLI commands.

## Error

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list snapshots prod ~3..NOW
```

```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
zsh: no such user or named directory: 3..NOW
```

## Solution

Wrap the argument in quotation marks (single or double):

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list snapshots prod '~3..NOW'
```

or

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list snapshots prod "~3..NOW"
```


# Reporting a custom attestation
Source: https://docs.kosli.com/tutorials/attest_custom

Walk through reporting a kosli attest custom attestation against a trail or an artifact, using the different ways to identify the artifact.

In this tutorial, you'll report a <Tooltip>custom attestation</Tooltip> with [`kosli attest custom`](/client_reference/kosli_attest_custom). You'll see how to:

* Bind the attestation to a **trail** *or* to an **artifact** — two alternative options for the same command.
* Identify an artifact by letting Kosli fingerprint it (container image, file, or directory), or by passing a SHA256 fingerprint directly.
* Attest **before** the artifact has been reported, using the artifact's template name and a git commit.

## Prerequisites

* [Install Kosli CLI](/getting_started/install) and [set the common env vars](/getting_started/install/#assigning-flags-via-environment-variables) (`KOSLI_API_TOKEN`, `KOSLI_ORG`, `KOSLI_FLOW`, `KOSLI_TRAIL`).
* A Kosli flow and trail — see the [Getting started guide](/getting_started/flows) if you don't have one.
* A **custom attestation type** that already exists in your org. This is a hard requirement — `kosli attest custom --type <name>` will fail if `<name>` hasn't been created yet.

## 1. Create the custom attestation type first

Before you can report a custom attestation, the type referenced by `--type` must already exist in your Kosli org. You have two ways to create it:

* **CLI** — [`kosli create attestation-type`](/client_reference/kosli_create_attestation-type) (good for quick experiments).
* **Terraform** — the [`kosli_custom_attestation_type` resource](/terraform-reference/resources/custom_attestation_type) (recommended so the type is version-controlled).

For this tutorial we'll create a minimal `coverage-report` type that requires a `coverage` field of at least 80:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create attestation-type coverage-report \
  --description "Code coverage report" \
  --jq '.coverage >= 80'
```

Prepare a JSON file with the data you want to attest. Save it as `coverage.json`:

```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
{ "coverage": 92, "tool": "pytest-cov" }
```

In every example below, this `coverage.json` is the value of `--attestation-data`.

## 2. Report the attestation

A custom attestation can be bound to either a **trail** or an **artifact**. Pick the option that matches what you want to attest about.

<Tabs>
  <Tab title="Against a trail">
    Use this when the evidence applies to the trail as a whole (e.g. overall test results, release readiness, change approval) and is not tied to a specific build artifact.

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest custom \
      --type coverage-report \
      --name overall-coverage \
      --attestation-data coverage.json
    ```

    `--name` must match an attestation declared in the flow or trail YAML template.
  </Tab>

  <Tab title="Against an artifact">
    Use this when the evidence is about a specific build artifact (a container image, a file, or a directory). You can identify the artifact in two ways: let Kosli compute the SHA256 fingerprint for you, or pass the fingerprint directly.

    #### Option A — Let Kosli fingerprint the artifact

    Pass the artifact reference as a positional argument together with `--artifact-type`. Supported types:

    | `--artifact-type` | Positional argument                                              | Notes                                                                                                                       |
    | :---------------- | :--------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------- |
    | `oci`             | Container image reference (e.g. `ghcr.io/acme/web:1.2.3`)        | Kosli pulls the digest from the registry. For private registries also pass `--registry-username` and `--registry-password`. |
    | `docker`          | Image present in the local Docker daemon (e.g. `acme/web:1.2.3`) | Reads the digest from the local daemon — no registry call.                                                                  |
    | `file`            | Path to a single file (e.g. `./dist/app.tar.gz`)                 |                                                                                                                             |
    | `dir`             | Path to a directory (e.g. `./build/`)                            | Use `--exclude` to skip files/dirs from the fingerprint (e.g. `--exclude '**/*.log,**/node_modules'`).                      |

    **Container image — fingerprint from a registry:**

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest custom ghcr.io/acme/web:1.2.3 \
      --artifact-type oci \
      --type coverage-report \
      --name overall-coverage \
      --attestation-data coverage.json
    ```

    **Container image — fingerprint from the local Docker daemon:**

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest custom acme/web:1.2.3 \
      --artifact-type docker \
      --type coverage-report \
      --name overall-coverage \
      --attestation-data coverage.json
    ```

    **File artifact:**

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest custom ./dist/app.tar.gz \
      --artifact-type file \
      --type coverage-report \
      --name overall-coverage \
      --attestation-data coverage.json
    ```

    **Directory artifact:**

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest custom ./build/ \
      --artifact-type dir \
      --exclude '**/*.log,**/node_modules' \
      --type coverage-report \
      --name overall-coverage \
      --attestation-data coverage.json
    ```

    #### Option B — Match the artifact by SHA256 with `--fingerprint`

    Use this when you already have the SHA256 (e.g. computed earlier in the pipeline, returned by `kosli fingerprint`, or printed by your build tool). Omit the positional argument and `--artifact-type`.

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest custom \
      --fingerprint 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 \
      --type coverage-report \
      --name overall-coverage \
      --attestation-data coverage.json
    ```

    `--fingerprint` and `--artifact-type` are mutually exclusive — pick one.
  </Tab>
</Tabs>

## 3. Attest before the artifact exists

You can report an attestation for an artifact that hasn't been reported to Kosli yet. Reference the artifact by its **template name** from the flow YAML and pass `--commit` so Kosli can bind the attestation when the artifact is later reported.

When you pass `--commit` without a fingerprint, Kosli does **not** calculate or assume any fingerprint. Instead, it stores the attestation as *pending* against the artifact's **template name + commit**, and binds it to the real fingerprint later — when an `artifact` attestation arrives for that same template name and commit.

### How it works in practice

Say your flow template defines an artifact called `artifact` with an attestation `test`:

```yml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
artifacts:
  - name: artifact
    attestations:
      - name: test
        type: junit
```

You can run tests **before** the artifact is built and report:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest junit \
  --name artifact.test \
  --commit $(git rev-parse HEAD) \
  ...
```

Notice:

* `--name` uses the dotted form `<artifact-template-name>.<attestation-name>`.
* No fingerprint, no `--artifact-type`, no positional artifact argument.
* `--commit` is what tells Kosli **which future artifact** this attestation will belong to.

Later, when you build and report the artifact itself:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest artifact ./build/artifact.tar.gz \
  --artifact-type file \
  --name artifact \
  --commit $(git rev-parse HEAD)
```

Kosli matches the earlier `artifact.test` attestation to this newly-reported artifact because **both share the same template name (`artifact`) and the same git commit**. At that point the attestation is bound to the artifact's actual SHA256 fingerprint.

### Subtleties worth flagging

1. **The match key is `(template artifact name, git commit)`** — not the fingerprint. The fingerprint is only resolved retroactively once the artifact itself is reported.
2. **The artifact name must match the template.** `artifact.test` only works if your flow YAML declares an artifact named `artifact`. Without a template the dotted form has nothing to bind to.
3. **Same commit, both sides.** If the pre-artifact attestation uses commit `abc123` but the artifact is later reported with commit `def456`, they will not be linked. The attestation will stay floating, unbound to any artifact.
4. **The commit must be resolvable in a git repo.** `--commit` requires access to a real git repo so Kosli can pull commit metadata (author, message, branch, PR info). It's not just a string label.
5. **Multiple artifacts with the same name + commit will all match.** If you report the artifact more than once from the same commit (e.g. rebuilds), every matching artifact picks up the attestation. Attestations are append-only, so this is usually what you want.
6. **Order doesn't matter.** You can report `artifact.test` before or after `artifact` itself — Kosli binds them whenever both sides exist.
7. **Without a template (auto-created flow/trail)**, `--commit`-based pre-artifact attestations still work for binding, but there's no template-defined compliance requirement — the artifact's compliance only reflects the attestations actually made against it.
8. **`--commit` is *only required* for the pre-artifact case.** If you already have a fingerprint (via `--fingerprint` or `--artifact-type`), `--commit` is optional metadata.

## 4. Add an attachment (optional)

You can attach files or directories as evidence. They are compressed and stored in Kosli's evidence vault.

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest custom \
  --type coverage-report \
  --name overall-coverage \
  --attestation-data coverage.json \
  --attachments ./coverage-report.html
```

## What you've accomplished

You can now report a `custom` attestation in every relevant shape:

* against a trail, or against an artifact (by fingerprint or by name + commit);
* identifying the artifact via container image, file, directory, or a raw SHA256.

From here:

* [`kosli attest custom`](/client_reference/kosli_attest_custom) reference — full flag list.
* [`kosli create attestation-type`](/client_reference/kosli_create_attestation-type) reference — for managing types via CLI.
* [Terraform: `kosli_custom_attestation_type`](/terraform-reference/resources/custom_attestation_type) — recommended for managing types as code.
* [Tutorial: Creating a custom CTRF attestation type](/tutorials/custom-attestation-ctrf) — a worked example of a real-world custom type.


# Attesting large documents (SBOMs, SARIF, vulnerability reports)
Source: https://docs.kosli.com/tutorials/attest_large_documents

How to attest large security and compliance reports in Kosli using summary attestations and the Evidence Vault

In this tutorial, we will attest a large security report to Kosli using a lightweight summary for compliance evaluation, with the full document preserved in the Evidence Vault for audit purposes.
By the end, you will have a Kosli attestation that captures the key facts from your report — vulnerability counts, severity levels, pass/fail status — and links to the full file for audit access.

This two-part approach keeps attestation payloads focused on what compliance rules need to evaluate, while ensuring the raw evidence remains available.

<Note>
  The `--attestation-data` JSON payload sent by `kosli attest custom` is limited to 1 MB — exceeding it returns a 400 error. Distill larger reports into a summary and attach the full document with `--attachments`, as described below.
</Note>

## Prerequisites

* [Install Kosli CLI](/getting_started/install).
* [Get a Kosli API token](/getting_started/authenticating_to_kosli).
* A Kosli flow and trail to attest to — follow the [Getting started guide](/getting_started/flows) if you need one.
* A report file to attest (e.g. an SBOM in JSON format, or a SARIF vulnerability report).

## Step 1: Create a summary attestation type

Define a custom attestation type that captures the key facts from your report. In this example we use a vulnerability report distilled into a summary JSON file:

```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
{
  "critical": 0,
  "high": 2,
  "medium": 14,
  "low": 37
}
```

Create an attestation type that enforces a zero-critical-findings rule:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create attestation-type vulnerability-summary \
  --description "Summary of vulnerability scan findings" \
  --jq '.critical == 0'
```

You should see: `attestation-type vulnerability-summary was created`.

You can verify it with:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get attestation-type vulnerability-summary
```

## Step 2: Distill your report into a summary

Use `jq` (or any other tool) to extract the fields you care about from your full report and write them to a summary file.

For example, if your tool produces a SARIF file, you might count findings by severity and write the result to `vuln-summary.json`.

The exact transformation will depend on your tool's output format. The goal is a small JSON object that your attestation type's rules can evaluate.

## Step 3: Attest the summary and attach the full report

Use `--attachments` to upload the full report to the Evidence Vault alongside the summary attestation:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest custom \
  --type vulnerability-summary \
  --name security-scan \
  --flow <your-flow-name> \
  --trail <your-trail-name> \
  --attestation-data vuln-summary.json \
  --attachments full-report.sarif
```

Kosli will:

* Evaluate the jq rule against `vuln-summary.json` to determine compliance.
* Store `full-report.sarif` in the Evidence Vault, linked to this attestation.

## Step 4: Verify the attestation

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get attestation <attestation-name> \
  --flow <your-flow-name> \
  --trail <your-trail-name>
```

The attestation record will show the compliance status and include a link to the attached file in the Evidence Vault.

## What you've accomplished

You have attested a security report to Kosli using a lightweight summary for compliance evaluation, with the full document preserved in the Evidence Vault for audit purposes.

From here you can:

* Read the [`kosli create attestation-type`](/client_reference/kosli_create_attestation-type) reference for all available options.
* Read the [`kosli attest custom`](/client_reference/kosli_attest_custom) reference for attesting to artifacts.
* Review [naming conventions for attestation types](/implementation_guide/phase_2/plan_organizational_structure/naming_conventions/attestation_types).


# Attesting Snyk scans
Source: https://docs.kosli.com/tutorials/attest_snyk

In this tutorial, we will see how you can run and attest different types of Snyk scans to Kosli. We will run the scans on the Kosli CLI git repo

In this tutorial, we will run Snyk scans against the Kosli CLI git repo and attest the results to a Kosli trail.
By the end, you will have a Kosli trail with attested Snyk scan results that you can view in the Kosli app.

## Prerequisites

To follow the steps in this tutorial, you need to:

* [Setup Snyk on your machine](https://docs.snyk.io/snyk-cli/getting-started-with-the-snyk-cli#install-the-snyk-cli-and-authenticate-your-machine).
* [Install Helm](https://helm.sh/docs/intro/install/) if you want to try Snyk IaC attestations, otherwise skip.
* [Install Docker](https://docs.docker.com/engine/install/) if you want to try Snyk container attestations, otherwise skip.
* [Install Kosli CLI](/getting_started/install).
* [Get a Kosli API token](/getting_started/authenticating_to_kosli).

## Setup

Set the `KOSLI_ORG` environment variable to your personal org name and `KOSLI_API_TOKEN` to your token:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=<your-personal-kosli-org-name>
export KOSLI_API_TOKEN=<your-api-token>
```

Clone the Kosli CLI git repo:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
git clone https://github.com/kosli-dev/cli.git
cd cli
```

## Create a Flow and Trail

We will start by creating a flow in Kosli to contain trails and artifacts for this tutorial:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create flow snyk-demo --use-empty-template
```

You should see: `flow snyk-demo was created`.

Then start a trail to bind our Snyk attestations to:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli begin trail test-1 --flow snyk-demo
```

You should see: `trail 'test-1' was begun`.

## Attest Snyk scans

We can now run Snyk scans and attest them to the trail. After each attestation, you can verify the result by navigating to **[https://app.kosli.com/\`your-personal-org-name\`/flows/snyk-demo/trails/test-1](https://app.kosli.com/`your-personal-org-name`/flows/snyk-demo/trails/test-1)** in the Kosli app.

### Open Source scan

[Snyk Open Source](https://docs.snyk.io/scan-using-snyk/snyk-open-source) finds vulnerabilities in the open-source libraries used by your application:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
snyk test --sarif-file-output=os.json

kosli attest snyk --flow snyk-demo --trail test-1 --name open-source-scan --scan-results os.json --commit HEAD
```

You should see: `snyk attestation 'open-source-scan' is reported to trail: test-1`.

### Code scan

[Snyk Code](https://docs.snyk.io/scan-using-snyk/snyk-code) scans your source code for security issues:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
snyk code test --sarif-file-output=code.json

kosli attest snyk --flow snyk-demo --trail test-1 --name code-scan --scan-results code.json --commit HEAD
```

You should see: `snyk attestation 'code-scan' is reported to trail: test-1`.

### Container scan

[Snyk Container](https://docs.snyk.io/scan-using-snyk/snyk-container) scans container images for security issues:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
docker pull ghcr.io/kosli-dev/cli:v2.8.3
snyk container test ghcr.io/kosli-dev/cli:v2.8.3 --file=Dockerfile --sarif-file-output=container.json

kosli attest snyk --flow snyk-demo --trail test-1 --name container-scan --scan-results container.json --commit HEAD
```

You should see: `snyk attestation 'container-scan' is reported to trail: test-1`.

### IaC scan

[Snyk IaC](https://docs.snyk.io/scan-using-snyk/snyk-iac) scans IaC configuration files (Terraform, Kubernetes, Helm) for security issues:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
helm template ./charts/k8s-reporter --output-dir helm \
  --set kosliApiToken.secretName=secret \
  --set reporterConfig.kosliEnvironmentName=foo \
  --set reporterConfig.kosliOrg=bar

snyk iac test helm --sarif-file-output=helm.json

kosli attest snyk --flow snyk-demo --trail test-1 --name helm-scan --scan-results helm.json --commit HEAD
```

You should see: `snyk attestation 'helm-scan' is reported to trail: test-1`.

## What you've accomplished

You have run four types of Snyk scans and attested each result to a Kosli trail. The trail now holds a tamper-proof record of your scan findings, linked to a specific git commit.

From here you can:

* Explore the trail in the [Kosli app](https://app.kosli.com)
* Attest scans to an artifact in a trail — see [`kosli attest snyk`](/client_reference/kosli_attest_snyk) for details
* Add Snyk attestations to your CI pipeline using the [GitHub Action](/github-action-reference/setup_cli_action)


# Using Kosli CLI with an HTTP proxy
Source: https://docs.kosli.com/tutorials/cli_and_http_proxy

This tutorial shows you how to set up an HTTP proxy and configure the Kosli CLI to route all traffic through it.

In enterprises with strict network policies, all egress traffic to external services must go through an HTTP proxy.
By the end of this tutorial, you will have an HTTP proxy running locally and the Kosli CLI configured to use it.

<Info>
  If you already have an HTTP proxy running, skip to [Use the HTTP proxy with Kosli CLI](#use-the-http-proxy-with-kosli-cli).
</Info>

## Prerequisites

* [Install Docker](https://docs.docker.com/engine/install/).
* [Install Kosli CLI](/getting_started/install).
* [Get a Kosli API token](/getting_started/authenticating_to_kosli).

## Start the HTTP proxy

We will use [Tinyproxy](https://tinyproxy.github.io/) running in Docker as our HTTP proxy.

Create a minimal Tinyproxy configuration and start it:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
cat <<EOF > tinyproxy.conf
User nobody
Group nobody
Port 8888
EOF

docker run -p 8888:8888 -v $(PWD)/tinyproxy.conf:/etc/tinyproxy/tinyproxy.conf:ro kalaksi/tinyproxy
```

You should see Tinyproxy log output in the terminal, confirming it is listening on port 8888.

## Use the HTTP proxy with Kosli CLI

In a new terminal, verify the setup by listing environments from the public `cyber-dojo` demo org:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list envs --org cyber-dojo --http-proxy http://localhost:8888 --api-token <your-token>
```

Your request is routed through the proxy and forwarded to Kosli. You should see output similar to:

```
NAME                         TYPE  LAST REPORT                LAST MODIFIED              TAGS
aws-beta                     ECS   2024-04-18T15:17:54+02:00  2024-04-18T15:17:54+02:00  [url=https://beta.cyber-dojo.org/]
aws-prod                     ECS   2024-04-18T15:17:57+02:00  2024-04-18T15:17:57+02:00  [url=https://cyber-dojo.org/]
terraform-state-differ-beta  S3    2024-04-18T15:18:23+02:00  2024-04-18T15:18:23+02:00
terraform-state-differ-prod  S3    2024-04-18T15:18:17+02:00  2024-04-18T15:18:17+02:00
```

If your proxy requires authentication, embed the credentials in the proxy URL:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list envs --org cyber-dojo --http-proxy http://username:password@proxy-host:8080 --api-token <your-token>
```

## More examples

Once the proxy is running, any Kosli CLI command can be routed through it by adding the `--http-proxy` flag. Here are some common examples:

**Report a Docker image artifact through the proxy:**

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest artifact my-app:latest \
  --artifact-type docker \
  --flow my-flow \
  --trail $(git rev-parse HEAD) \
  --name my-app \
  --http-proxy http://localhost:8888 \
  --api-token <your-token> \
  --org <your-org>
```

**Snapshot a Kubernetes cluster through the proxy:**

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli snapshot k8s my-k8s-env \
  --kubeconfig ~/.kube/config \
  --namespaces production \
  --http-proxy http://localhost:8888 \
  --api-token <your-token> \
  --org <your-org>
```

**Attach a JUnit test attestation through the proxy:**

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest junit \
  --name unit-tests \
  --flow my-flow \
  --trail $(git rev-parse HEAD) \
  --results-dir ./test-results \
  --http-proxy http://localhost:8888 \
  --api-token <your-token> \
  --org <your-org>
```

## Persist the proxy configuration

Rather than passing `--http-proxy` on every command, save it to your Kosli config:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli config --http-proxy=http://localhost:8888
```

All subsequent CLI commands will now route through the proxy automatically.

## Scope of `--http-proxy`

The `--http-proxy` flag only applies to traffic between the CLI and the Kosli API. Commands that integrate with third-party services (GitHub, GitLab, Jira, SonarCloud/SonarQube, Azure, AWS) use separate HTTP clients that are **not** affected by this flag. To proxy that traffic, set the standard `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY` environment variables separately.

The table below shows every external endpoint the CLI may contact and how to proxy each one:

| Destination           | Endpoint                                                        | Commands                                        | Proxy method                            |
| --------------------- | --------------------------------------------------------------- | ----------------------------------------------- | --------------------------------------- |
| Kosli API             | `https://app.kosli.com` (configurable via `--host`)             | All commands                                    | `--http-proxy` or `HTTPS_PROXY`         |
| GitHub                | `https://api.github.com` (configurable via `--github-base-url`) | PR/commit attestations                          | `HTTPS_PROXY` only                      |
| GitLab                | `https://gitlab.com` (configurable via `--gitlab-base-url`)     | PR attestations                                 | `HTTPS_PROXY` only                      |
| Jira                  | Configured via `--jira-base-url`                                | Jira attestations                               | `HTTPS_PROXY` only                      |
| SonarCloud/SonarQube  | `https://sonarcloud.io` (configurable via `--sonar-server-url`) | Sonar attestations                              | `HTTPS_PROXY` only                      |
| Azure DevOps          | Configured via `--azure-org-url`                                | Azure PR attestations                           | `HTTPS_PROXY` only                      |
| Azure management APIs | Azure ARM/IMDS endpoints                                        | Azure app snapshots                             | `HTTPS_PROXY` only                      |
| AWS APIs              | Regional AWS endpoints                                          | ECS / Lambda / S3 snapshots                     | `HTTPS_PROXY` only                      |
| Container registries  | OCI registries (ECR, GCR, DockerHub, etc.)                      | Artifact fingerprinting (`--artifact-type oci`) | `HTTPS_PROXY` only                      |
| Kubernetes API server | In-cluster or via kubeconfig                                    | `snapshot k8s`                                  | kubeconfig `proxy-url` or `HTTPS_PROXY` |

### Corporate proxies requiring Kerberos or NTLM

Go's HTTP client only supports Basic authentication for proxies. If your corporate proxy requires Kerberos or NTLM (common in large enterprises), run a local auth-handling proxy such as [cntlm](https://cntlm.sourceforge.net/) or [px](https://github.com/genotrance/px), then point `HTTPS_PROXY` at `http://127.0.0.1:<local-port>`.

## Kubernetes reporter

The `snapshot k8s` command makes two independent outbound connections:

1. **Kubernetes API server** — uses the kubeconfig for connection and authentication. Configure the proxy via the kubeconfig `proxy-url` field or the `HTTPS_PROXY` environment variable.
2. **Kosli API** — uses the standard Kosli HTTP client, controlled by `--http-proxy`.

These two connections must be configured independently.

## What you've accomplished

You have set up Tinyproxy as an HTTP proxy and configured the Kosli CLI to route all traffic through it. This pattern works with any HTTP proxy — replace `http://localhost:8888` with your organization's proxy URL and run `kosli config --http-proxy=<your-proxy-url>` to apply it globally.


# Creating custom CTRF attestation type
Source: https://docs.kosli.com/tutorials/custom-attestation-ctrf

In this tutorial, we will create a custom attestation type with schema and evaluation for Common Test Report Format

In this tutorial, we will create a <Tooltip>custom attestation type</Tooltip> for <Tooltip href="https://ctrf.io/">CTRF</Tooltip>.
By the end, you will have a reusable `ctrf` attestation type in Kosli that validates test reports and enforces a zero-failures compliance rule.

## Prerequisites

* [Install Kosli CLI](/getting_started/install).
* [Get a Kosli API token](/getting_started/authenticating_to_kosli).
* A Kosli flow and trail to attest to — follow the [Getting started guide](/getting_started/flows) if you need one.

## Download the CTRF schema

Download the official <Tooltip href="https://json-schema.org/learn">JSON schema</Tooltip> for CTRF to a file named `ctrf-schema.json`:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
curl -o ctrf-schema.json https://ctrf.io/schemas/schema.json
```

## Create the attestation type

Use `kosli create attestation-type` to define the new type with a <Tooltip href="https://jqlang.github.io/jq/">jq compliance rule</Tooltip> that requires zero failed tests:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create attestation-type ctrf \
  --description "Attestation for Common Test Report Format (CTRF)" \
  --schema ctrf-schema.json \
  --jq '.results.summary.failed == 0'
```

You should see: `attestation-type ctrf was created`.

You can verify it exists by running:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get attestation-type ctrf
```

## Report a CTRF attestation

Once your tests have run and produced a CTRF report (e.g. `ctrf-report.json`), report it to Kosli:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest custom \
  --type ctrf \
  --name playwright-tests \
  --flow <your-flow-name> \
  --trail <your-trail-name> \
  --attestation-data ctrf-report.json
```

Kosli will validate `ctrf-report.json` against the schema and evaluate the jq rule. If `.results.summary.failed` is 0, the attestation will be marked as compliant.

## What you've accomplished

You have created a reusable `ctrf` custom attestation type and used it to report a test result to Kosli. Any team in your organization can now use this same type to uniformly enforce a zero-failures quality gate across all projects, regardless of which testing framework they use.

From here you can:

* Read the [`kosli create attestation-type`](/client_reference/kosli_create_attestation-type) reference for all available options
* Read the [`kosli attest custom`](/client_reference/kosli_attest_custom) reference for attesting to artifacts
* Review [naming conventions for attestation types](/implementation_guide/phase_2/plan_organizational_structure/naming_conventions/attestation_types)


# Detecting non-Terraform changes
Source: https://docs.kosli.com/tutorials/detecting_non_terraform_changes

Detect infrastructure changes made outside Terraform — console, API, or CLI edits — with a scheduled plan whose result is attested into a Kosli Environment.

<Tooltip>Terraform drift</Tooltip> comes in two distinct types, and each is invisible to a detector built for the other:

1. **Unexpected statefile changes** — someone runs `terraform apply` outside your pipeline, so the statefile and the world still agree and a plan comes back empty. See [Detecting unexpected statefile changes](/tutorials/detecting_unexpected_statefile_changes).
2. **Non-Terraform changes** — someone edits the world directly via the cloud console, API, or CLI: a hotfix in the console, a partial apply failure, an out-of-band automation. Reality no longer matches the statefile, so a `terraform plan` catches it. This page covers detecting this type.

Both pages implement Kosli's [Drift Detection](https://sdlc.kosli.com/controls/runtime/drift_detection/) control (SDLC-CTRL-0018), a detective control that mitigates configuration drift risk under our secure SDLC framework.

## How the detection works

The detector is a scheduled `terraform plan` against the last-applied git SHA, with the result recorded in a small marker file that Kosli watches for tampering:

* **At apply time**, the pipeline writes a fresh marker — `drift.plan.json`, stored next to the statefile — recording the applied SHA with `drift: false`, and attests it into your [Kosli Environment](/getting_started/environments):

  ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  {
    "sha": "abc123def456...",
    "drift": false
  }
  ```

* **On a schedule**, the detector reads the marker, checks out the recorded SHA, and runs a read-only plan. The cleanest machine-readable signal is the plan exit code:

  ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
  terraform plan -input=false -lock=false -detailed-exitcode -no-color -out=tfplan
  # exit 0  -> no changes  (no drift)
  # exit 2  -> changes present  (DRIFT)
  # exit 1  -> error
  ```

  `-lock=false` means the read-only drift plan never contends with a real apply; `-input=false` means it can never hang waiting for a prompt.

* **When drift is found**, the detector overwrites the marker in S3 with `{sha, drift: <timestamp>}` — fresh, un-attested content. On its next snapshot, the Kosli reporter Lambda sees a marker that no longer matches its attestation, and the Environment reports itself as **non-compliant**.

<Tip>
  The detector never calls the Kosli API. It just rewrites the marker in S3; the reporter Lambda does the detection on its next snapshot. Detection and evidence stay decoupled — fewer moving parts, one less credential in the detector, and a single place (the Environment) that tells you whether the world still matches what was approved. The Environment's compliance state, backed by attested artifacts linked to the git SHA that produced them, is exactly the kind of evidence an auditor wants for SOC 2 (CC7.2, CC8.1) and NIST SP 800-53 (CM-2, CM-3, SI-7).
</Tip>

## Plan against the applied SHA, not against `main`

This is the single most common false-positive source. If changes are merged to `main` but not yet applied — because the apply is gated behind a manual approval, or batched into a release — then planning against `main` shows a non-empty plan that reflects pending intentional changes, not drift. The marker exists precisely to record the *applied* SHA, and the detector always checks out that commit before planning.

## Latch, don't spam

Once drift is flagged, you usually don't want to re-plan and re-alert every cycle until someone acts. The marker doubles as a latch: the detector only plans while `drift` is `false`, and the next successful apply writes a fresh `{sha, drift: false}` marker to reset it.

## Prerequisites

* Terraform is applied through CI/CD, not from laptops, as the normal path — with remote, locked state (for example, an S3 backend with the native S3 lockfile or DynamoDB).
* Keyless CI authentication to your cloud (for example, GitHub OIDC) with a dedicated, read-capable role for the detector. The detector never needs apply permissions.
* A [Kosli account and API token](/getting_started/authenticating_to_kosli).
* A Kosli [Environment](/getting_started/environments) for each Terraform environment you want to protect.
* The Kosli reporter Lambda deployed to snapshot the drift marker (and statefile) into that Environment on a schedule.

<Warning>
  Drift detection on top of an undisciplined apply process produces mostly noise. Fix the pipeline first.
</Warning>

## Setting it up with `kosli-dev/tf`

Everything above is implemented at [github.com/kosli-dev/tf](https://github.com/kosli-dev/tf): a thin Terraform wrapper (`tf`) and a set of reusable GitHub Actions workflows, both open source under the MIT license. Two of the workflows carry this control:

* **`apply.yml`** — the plan steps plus `tf apply`, then a reset-drift-detection job that writes a fresh `{sha, drift: false}` marker to S3 (the known-good baseline for the next drift run) and attests it, along with the plan, apply log, and statefile, into your Kosli Environment. See [Detecting unexpected statefile changes](/tutorials/detecting_unexpected_statefile_changes) for the caller workflow and flow template — the same apply setup covers both drift types.
* **`detect-drift.yml`** — the detector. Reads the baseline marker, and only if `drift == false` runs a plan against the baseline SHA. A non-empty plan overwrites the marker with `{sha, drift: <timestamp>}`; otherwise it records a no-drift summary.

A scheduled caller that runs the detector (use a matrix to fan out across environments):

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
name: Drift
on:
  schedule:
    - cron: "*/15 * * * *"
  workflow_dispatch:

jobs:
  drift:
    uses: kosli-dev/tf/.github/workflows/detect-drift.yml@main
    permissions:
      id-token: write
      contents: write
    with:
      aws_region:   eu-west-1
      aws_role_arn: arn:aws:iam::111122223333:role/my-role
      environment:  production
```

## Hardening

A detector that runs once and alerts once is easy. A detector you can depend on for an audit needs to handle the failure modes below.

<AccordionGroup>
  <Accordion title="Monitor the monitor" icon="heart-pulse">
    This is the most dangerous failure mode. If the scheduled job silently stops running, no new evidence arrives to contradict the last result — so the environment looks green forever, even as drift accumulates. Treating "the dashboard is green" as proof of cleanliness, without also verifying the underlying job is running on schedule, is a misuse of the control. Add a heartbeat or alert on "job has not run in N intervals" for both the detector workflow and the reporter Lambda.
  </Accordion>

  <Accordion title="Terraform-managed resources only" icon="filter">
    `terraform plan` can only see resources Terraform manages. A resource created entirely outside Terraform — say, an IAM user added by hand in the console with no corresponding Terraform resource — is invisible to this control. Closing that gap is the job of an Infrastructure-as-Code coverage policy (everything in production must be defined as code in the first place); drift detection assumes that policy holds and does not substitute for it.
  </Accordion>

  <Accordion title="Tune cadence per environment" icon="gauge">
    Worst-case detection latency is the check interval **plus the reporter Lambda's snapshot interval**. A ten-minute check with a five-minute reporter Lambda surfaces drift within fifteen minutes. Set the schedule from each environment's rate-of-change and blast radius rather than using one global value.
  </Accordion>

  <Accordion title="Concurrency and least privilege" icon="lock">
    Guard against overlapping runs for the same environment with a concurrency group. Scope the detector's cloud role tightly: it needs to read state and plan, plus write the marker file — nothing more. It must never hold apply permissions.
  </Accordion>
</AccordionGroup>

## Implementation checklist

* [ ] Terraform is applied through CI/CD, with remote, locked state.
* [ ] Each apply writes a fresh `{sha, drift: false}` marker and attests it into a Kosli Environment.
* [ ] A scheduled job plans against the applied SHA — not against `main` — using a read-only, lock-free plan.
* [ ] A non-empty plan overwrites the marker; the result latches until the next apply resets it.
* [ ] The Kosli reporter Lambda snapshots the marker from S3 into the Environment on a schedule.
* [ ] Both the detector workflow and the reporter Lambda are monitored for silent failure.
* [ ] The detector's cloud role can read and plan only — never apply.
* [ ] Cadence and concurrency are tuned per environment.

## Related

* [Drift Detection (SDLC-CTRL-0018)](https://sdlc.kosli.com/controls/runtime/drift_detection/) — the control both drift-detection tutorials implement.
* [Detecting unexpected statefile changes](/tutorials/detecting_unexpected_statefile_changes) — the other drift type: out-of-CI applies a plan can *never* catch.
* [`kosli-dev/tf`](https://github.com/kosli-dev/tf) — the reference wrapper and reusable workflows.
* [Environments](/getting_started/environments) — the Kosli primitive that carries the compliance signal.
* [Terraform `-detailed-exitcode`](https://developer.hashicorp.com/terraform/cli/commands/plan#detailed-exitcode) and [remote/locked S3 backends](https://developer.hashicorp.com/terraform/language/backend/s3).


# Detecting unexpected statefile changes
Source: https://docs.kosli.com/tutorials/detecting_unexpected_statefile_changes

Detect Terraform applies that bypass CI by attesting statefile provenance into a Kosli Environment — the class of drift a scheduled plan can never see.

<Tooltip>Terraform drift</Tooltip> comes in two distinct types, and each is invisible to a detector built for the other:

1. **Unexpected statefile changes** — someone runs `terraform apply` outside your pipeline. A laptop apply updates the statefile and the world *together*, so they still agree and a scheduled `terraform plan` comes back empty. This page covers detecting this type.
2. **Non-Terraform changes** — someone edits the world directly via the cloud console, API, or CLI, so reality no longer matches the statefile. See [Detecting non-Terraform changes](/tutorials/detecting_non_terraform_changes).

Both pages implement Kosli's [Drift Detection](https://sdlc.kosli.com/controls/runtime/drift_detection/) control (SDLC-CTRL-0018), a detective control that mitigates configuration drift risk under our secure SDLC framework.

## Why a plan can never catch this

`terraform plan` compares the statefile to the world. An out-of-CI apply changes both in lockstep, so the comparison stays clean — the plan is structurally blind to it. What *has* changed is the statefile itself: it is now a file your pipeline never produced. Detecting that requires a record of where every statefile came from — a provenance system.

## How Kosli detects it

The mechanism is **attestation plus continuous reporting** against a [Kosli Environment](/getting_started/environments):

* **At apply time**, the pipeline attests the Terraform statefile as an artifact into the Kosli Environment. Attestation fingerprints the file and records that your pipeline produced it, linked to the git SHA — establishing its provenance.
* **Continuously**, a scheduled Kosli reporter Lambda snapshots the live statefile from S3 into the same Environment. The Environment's policy requires every artifact to have known provenance.

The moment the statefile in S3 no longer matches an attestation — because an apply outside CI rewrote it — the next snapshot sees an unrecognized artifact and the Environment reports itself as **non-compliant**. No scheduled plan is involved; the reporter Lambda detects this entirely on its own.

<Tip>
  "The plan was clean yesterday" is not evidence that the environment is clean today. A green dashboard can be stale (the job stopped running) or unverifiable (who can prove the statefile wasn't swapped?). Only a **current, verifiable** signal counts as evidence — which is why the signal here is a Kosli Environment's compliance state, backed by attested artifacts. That is exactly the kind of evidence an auditor wants for SOC 2 (CC7.2, CC8.1) and NIST SP 800-53 (CM-2, CM-3, SI-7).
</Tip>

## Prerequisites

* Terraform is applied through CI/CD, not from laptops, as the normal path — with remote, locked state (for example, an S3 backend with the native S3 lockfile or DynamoDB).
* Keyless CI authentication to your cloud (for example, GitHub OIDC).
* A [Kosli account and API token](/getting_started/authenticating_to_kosli).
* A Kosli [Environment](/getting_started/environments) for each Terraform environment you want to protect.
* The Kosli reporter Lambda deployed to snapshot the statefile into that Environment on a schedule.

## Setting it up with `kosli-dev/tf`

Everything above is implemented at [github.com/kosli-dev/tf](https://github.com/kosli-dev/tf): a thin Terraform wrapper (`tf`) and a set of reusable GitHub Actions workflows, both open source under the MIT license. You can call the workflows directly, or borrow their shape for your own CI.

### The wrapper

`tf` is a drop-in replacement for `terraform` that removes the manual bookkeeping. It selects the correct `-var-file` for your active AWS profile and region, and injects the S3 backend config so you never hand-manage it. The backend is derived deterministically:

```text theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
bucket  = terraform-state-<sha1(account_id-region)>
key     = terraform/<repo>/<state_file_name>     # default: main.tfstate
region  = <region>          encrypt = true       # native S3 lockfile by default
```

`tf plan` saves a binary plan for later inspection; `tf apply` appends `-auto-approve` (the plan has already been reviewed, and CI has no interactive prompt). Locally you wrap it in your credential helper, for example `aws-vault exec staging -- tf plan`.

### The apply workflow

The reusable `apply.yml` workflow runs the plan steps plus `tf apply`, then attests the plan, the apply log, and the statefile into your Kosli Environment. A caller workflow that applies on merge:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
name: Apply

on:
  push:
    branches: [main]

jobs:
  apply:
    uses: kosli-dev/tf/.github/workflows/apply.yml@main
    permissions:
      id-token: write
      contents: write
      pull-requests: read          # needed by the PR-attestation step
    with:
      aws_region:   eu-west-1
      aws_role_arn: arn:aws:iam::111122223333:role/my-role
      environment:  production
      tf_version:   v1.14.6
      kosli_template_file: kosli-apply-template.yml
    secrets:
      kosli_api_token:    ${{ secrets.KOSLI_API_TOKEN }}
      kosli_github_token: ${{ secrets.GITHUB_TOKEN }}
```

The Kosli [flow template](/template-reference/flow_template) declares every attestation and artifact the workflow emits:

```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# kosli-apply-template.yml
version: 1
trail:
  attestations:
    - name: terraform-plan
      type: generic
    - name: terraform-apply
      type: generic
  artifacts:
    - name: terraform-state
    - name: drift-plan
```

<Info>
  The `drift-plan` artifact belongs to the second drift type — the marker file used by the scheduled plan loop in [Detecting non-Terraform changes](/tutorials/detecting_non_terraform_changes). The same apply workflow attests both, so one setup covers both types.
</Info>

## What a detection looks like

Someone runs `terraform apply` from a laptop. The statefile in S3 is rewritten with content your pipeline never attested. On its next snapshot the Kosli reporter Lambda finds an artifact with no known provenance, and the Environment turns non-compliant. The Environment's snapshot history shows exactly when the unrecognized statefile appeared and what its fingerprint is — a concrete starting point for the investigation, and a durable record for the audit trail.

## Hardening

<AccordionGroup>
  <Accordion title="Monitor the monitor" icon="heart-pulse">
    This is the most dangerous failure mode. If the reporter Lambda silently stops running, no new evidence arrives to contradict the last snapshot — so the Environment looks green forever, even as unattested statefiles accumulate. Treating "the dashboard is green" as proof of cleanliness, without also verifying the Lambda is running on schedule, is a misuse of the control. Add a heartbeat or alert on "no snapshot in N intervals".
  </Accordion>

  <Accordion title="Least privilege" icon="lock">
    The reporter Lambda needs read access to the state bucket and the ability to report snapshots to Kosli — nothing more. It must never hold apply permissions.
  </Accordion>
</AccordionGroup>

## Implementation checklist

* [ ] Terraform is applied through CI/CD, with remote, locked state.
* [ ] Each apply attests the statefile (plus plan and apply log) into a Kosli Environment.
* [ ] The Kosli reporter Lambda snapshots the live statefile from S3 into the Environment on a schedule.
* [ ] The Environment's policy requires known provenance for every artifact.
* [ ] The reporter Lambda is monitored for silent failure (heartbeat / not-run alert).
* [ ] Snapshot cadence is tuned per environment.

## Related

* [Drift Detection (SDLC-CTRL-0018)](https://sdlc.kosli.com/controls/runtime/drift_detection/) — the control both drift-detection tutorials implement.
* [Detecting non-Terraform changes](/tutorials/detecting_non_terraform_changes) — the other drift type: console and API edits a plan *can* catch.
* [`kosli-dev/tf`](https://github.com/kosli-dev/tf) — the reference wrapper and reusable workflows.
* [Environments](/getting_started/environments) — the Kosli primitive that carries the compliance signal.
* [Flow template reference](/template-reference/flow_template) — declaring attestations and artifacts.


# Evaluate trails with OPA policies
Source: https://docs.kosli.com/tutorials/evaluate_trails_with_opa

Learn how to write safe OPA/Rego policies for kosli evaluate trail and kosli evaluate trails, including design rules that prevent false-positive compliance results.

The `kosli evaluate` commands let you evaluate Kosli trails against custom policies written in <Tooltip href="https://www.openpolicyagent.org/">[Rego](https://www.openpolicyagent.org/docs/latest/policy-language/)</Tooltip>. This is useful for enforcing rules like "every artifact must have an approved pull request" or "all security scans must pass", and for gating deployments in CI/CD pipelines based on those rules.

In this tutorial, you'll write and evaluate policies against real trails in public Kosli orgs. Along the way, you'll learn three design rules that prevent a Rego policy from granting false-positive compliance results.

<Steps>
  <Step title="Prerequisites">
    To follow this tutorial, you need to:

    * [Install Kosli CLI](/getting_started/install).
    * [Get a Kosli API token](/getting_started/authenticating_to_kosli).
    * Set the `KOSLI_API_TOKEN` environment variable to your token:

      ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
      export KOSLI_API_TOKEN=<your-api-token>
      ```

    <Info>
      You don't need OPA installed -- the Kosli CLI has a built-in Rego evaluator. You just need to write a `.rego` policy file.
    </Info>
  </Step>

  <Step title="Write a policy">
    Create a file called `pr-approved.rego` with the following content:

    ```rego pr-approved.rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    package policy

    import rego.v1

    pr_attestation_name := data.params.pr_attestation_name

    default allow = false

    violations contains msg if {
        some trail in input.trails
        some pr in trail.compliance_status.attestations_statuses[pr_attestation_name].pull_requests
        count(pr.approvers) == 0
        msg := sprintf("trail '%v': pull-request %v has no approvers", [trail.name, pr.url])
    }

    trail_is_approved(trail) if {
        every pr in trail.compliance_status.attestations_statuses[pr_attestation_name].pull_requests {
            count(pr.approvers) > 0
        }
    }

    allow if {
        every trail in input.trails {
            trail_is_approved(trail)
        }
    }
    ```

    This policy applies three design rules that every evaluate policy should follow.

    **Rule 1: `default allow = false` -- fail safe**

    Trails are denied unless the policy explicitly allows them. Anything the policy cannot positively verify is treated as non-compliant. This matches Kosli's compliance direction: a false non-compliant blocks a good trail (recoverable); a false compliant passes a bad one (not recoverable).

    The alias `pr_attestation_name := data.params.pr_attestation_name` reads the attestation name from a params file rather than hardcoding it. Different orgs and flows use different names for their pull-request attestation (for example `"pull-request"` or `"pr"`). If the param is absent, `pr_attestation_name` is undefined, the lookup into `attestations_statuses` fails, `trail_is_approved` does not fire, and `allow` stays `false` -- the correct fail-safe.

    **Rule 2: Drive `allow` via a positive assertion, not the absence of violations**

    `allow` fires through `trail_is_approved`, which makes a positive claim: every PR has at least one approver. It is never driven by `count(violations) == 0`.

    The following pattern looks equivalent but is not safe:

    ```rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    # unsafe
    allow if {
        count(violations) == 0
    }
    ```

    If the `violations` rule body references a field that does not exist -- a typo in `pull_requests`, an unexpected schema change, a missing key -- the rule body silently produces no messages. The violations set is empty, `count(violations) == 0` is true, and `allow` fires even though no PRs were actually checked. The trail receives a false-positive compliant result.

    With the safe pattern, if `pull_requests` is undefined, `every pr in ...` fails to evaluate, `trail_is_approved` does not fire, and `allow` stays `false`.

    **Rule 3: Violations provide diagnostics only**

    `violations` explains why a policy was denied -- it does not decide whether it was denied. When a `violations` rule body encounters an undefined reference, it silently produces no message. This is the safe failure mode: you lose a diagnostic, not a compliance check.

    <Info>
      See the [Rego Policy reference](/policy-reference/rego_policy) for the full policy contract, input data shape, and exit code behavior.
    </Info>
  </Step>

  <Step title="Evaluate multiple trails">
    Let's evaluate several trails from the public `cyber-dojo` org against our policy. The `kosli evaluate trails` command fetches trail data from Kosli and passes it to the policy as `input.trails`:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trails \
      --policy pr-approved.rego \
      --params '{"pr_attestation_name": "pull-request"}' \
      --org cyber-dojo \
      --flow dashboard-ci \
      9978a1ca82c273a68afaa85fc37dd60d1e394f84 \
      b334d371eb85c9a5c811776de1b65fb80b52d952 \
      5abd63aa1d64af7be5b5900af974dc73ae425bd6 \
      cb3ec71f5ce1103779009abaf4e8f8a3ed97d813
    ```

    The cyber-dojo project doesn't require PR approvals, so you'll see violations:

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    RESULT:      DENIED
    VIOLATIONS:  trail '5abd63aa1d64af7be5b5900af974dc73ae425bd6': pull-request https://github.com/cyber-dojo/dashboard/pull/342 has no approvers
                 trail '9978a1ca82c273a68afaa85fc37dd60d1e394f84': pull-request https://github.com/cyber-dojo/dashboard/pull/344 has no approvers
                 trail 'b334d371eb85c9a5c811776de1b65fb80b52d952': pull-request https://github.com/cyber-dojo/dashboard/pull/343 has no approvers
                 trail 'cb3ec71f5ce1103779009abaf4e8f8a3ed97d813': pull-request https://github.com/cyber-dojo/dashboard/pull/341 has no approvers
    ```

    Now try the `kosli-public` org, where PRs do have approvers. This org names the attestation `"pr"`:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trails \
      --policy pr-approved.rego \
      --params '{"pr_attestation_name": "pr"}' \
      --org kosli-public \
      --flow cli \
      5a0f3c0 \
      167ed93 \
      030cc31
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    RESULT:  ALLOWED
    ```
  </Step>

  <Step title="Evaluate a single trail">
    The `kosli evaluate trail` (singular) command evaluates facts within a single trail. For example, you might check that a Snyk container scan found no high-severity vulnerabilities.

    Save this as `snyk-no-high-vulns.rego`:

    ```rego snyk-no-high-vulns.rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    package policy

    import rego.v1

    default allow = false

    artifact_scan_is_clean(artifact) if {
        snyk := artifact.attestations_statuses["snyk-container-scan"]
        every result in snyk.processed_snyk_results.results {
            result.high_count == 0
        }
    }

    allow if {
        every _, artifact in input.trail.compliance_status.artifacts_statuses {
            artifact_scan_is_clean(artifact)
        }
    }

    violations contains msg if {
        some name, artifact in input.trail.compliance_status.artifacts_statuses
        snyk := artifact.attestations_statuses["snyk-container-scan"]
        some result in snyk.processed_snyk_results.results
        result.high_count > 0
        msg := sprintf("artifact '%v': snyk container scan found %d high severity vulnerabilities", [name, result.high_count])
    }
    ```

    `allow` fires only when `artifact_scan_is_clean` succeeds for every artifact. If `snyk-container-scan` is absent or `processed_snyk_results` is undefined, `artifact_scan_is_clean` fails to fire and `allow` stays `false`.

    Use `--attestations` to enrich only the snyk data (faster than fetching all attestation details).
    The value uses the format `artifact-name.attestation-type`. Here, `dashboard` is the artifact name and `snyk-container-scan` is the attestation name:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trail \
      --policy snyk-no-high-vulns.rego \
      --org cyber-dojo \
      --flow dashboard-ci \
      --attestations dashboard.snyk-container-scan \
      44ca5fa2630947cf375fdbda10972a4bedaaaba3
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    RESULT:  ALLOWED
    ```

    The trail has zero high-severity vulnerabilities, so the policy allows it.

    <Info>
      The `input.trail` / `input.trails` distinction and the full input data shape are documented in the [Rego Policy reference](/policy-reference/rego_policy#input-data).
    </Info>
  </Step>

  <Step title="Pass parameters to a policy">
    Policies often need thresholds that vary by environment -- stricter in production than in staging. Use the `--params` flag to pass these values as `data.params` rather than hardcoding them in the policy.

    Save this as `snyk-severity-threshold.rego`:

    ```rego snyk-severity-threshold.rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    package policy

    import rego.v1

    max_high   := data.params.max_high
    max_medium := data.params.max_medium

    default allow = false

    artifact_within_threshold(artifact) if {
        snyk := artifact.attestations_statuses["snyk-container-scan"]
        every result in snyk.processed_snyk_results.results {
            result.high_count   <= max_high
            result.medium_count <= max_medium
        }
    }

    allow if {
        every _, artifact in input.trail.compliance_status.artifacts_statuses {
            artifact_within_threshold(artifact)
        }
    }

    violations contains msg if {
        some name, artifact in input.trail.compliance_status.artifacts_statuses
        snyk := artifact.attestations_statuses["snyk-container-scan"]
        some result in snyk.processed_snyk_results.results
        result.high_count > max_high
        msg := sprintf("artifact '%v': %d high-severity vulnerabilities exceed limit of %d", [name, result.high_count, max_high])
    }

    violations contains msg if {
        some name, artifact in input.trail.compliance_status.artifacts_statuses
        snyk := artifact.attestations_statuses["snyk-container-scan"]
        some result in snyk.processed_snyk_results.results
        result.medium_count > max_medium
        msg := sprintf("artifact '%v': %d medium-severity vulnerabilities exceed limit of %d", [name, result.medium_count, max_medium])
    }
    ```

    **Why the aliases at the top matter**

    `max_high := data.params.max_high` is not just shorthand. In the compliance path, `result.high_count <= max_high` is a positive bound check. If `max_high` is absent from the params file, this condition is undefined, `artifact_within_threshold` fails to fire, and `allow` stays `false`. That is the correct fail-safe behavior.

    Compare this to a policy that drives `allow` through the absence of violations:

    ```rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    # unsafe
    violations contains msg if {
        result.high_count > data.params.max_high  # fails silently if max_high is absent
        msg := ...
    }

    allow if { count(violations) == 0 }
    ```

    If `data.params.max_high` is absent, the `violations` rule body fails silently, the set stays empty, and `allow` fires. A misconfigured params file grants compliance rather than denying it.

    **Testing with `kosli evaluate input`**

    You can test a policy locally without a real trail using `kosli evaluate input`. Create a minimal input file:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    cat > scan-input.json << 'EOF'
    {
      "trail": {
        "compliance_status": {
          "artifacts_statuses": {
            "dashboard": {
              "attestations_statuses": {
                "snyk-container-scan": {
                  "processed_snyk_results": {
                    "results": [{"high_count": 2, "medium_count": 5}]
                  }
                }
              }
            }
          }
        }
      }
    }
    EOF
    ```

    Evaluate with permissive staging thresholds:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate input \
      --input-file scan-input.json \
      --policy snyk-severity-threshold.rego \
      --params '{"max_high": 5, "max_medium": 10}'
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    RESULT:  ALLOWED
    ```

    Apply stricter production thresholds:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate input \
      --input-file scan-input.json \
      --policy snyk-severity-threshold.rego \
      --params '{"max_high": 0, "max_medium": 3}'
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    RESULT:      DENIED
    VIOLATIONS:  artifact 'dashboard': 2 high-severity vulnerabilities exceed limit of 0
                 artifact 'dashboard': 5 medium-severity vulnerabilities exceed limit of 3
    ```

    Now verify the fail-safe: omit `max_high` from params entirely:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate input \
      --input-file scan-input.json \
      --policy snyk-severity-threshold.rego \
      --params '{"max_medium": 10}'
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    RESULT:  DENIED
    ```

    `allow` is `false` even though no violation message was produced. The missing param causes the compliance check to fail, not to vacuously pass. Always verify this explicitly when writing a policy that relies on params.

    You can also load parameters from a file using the `@` prefix:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    echo '{"max_high": 0, "max_medium": 3}' > params-prod.json

    kosli evaluate input \
      --input-file scan-input.json \
      --policy snyk-severity-threshold.rego \
      --params @params-prod.json
    ```

    The `--params` flag works the same way on `kosli evaluate trail` and `kosli evaluate trails` -- parameters are always available as `data.params` in the policy.
  </Step>

  <Step title="Explore the policy input with --show-input">
    When writing policies, it helps to see exactly what data is available. Use `--show-input` combined with `--output json` to see the full input that gets passed to the policy:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trail \
      --policy snyk-no-high-vulns.rego \
      --org cyber-dojo \
      --flow dashboard-ci \
      --attestations dashboard.snyk-container-scan \
      --show-input \
      --output json \
      44ca5fa2630947cf375fdbda10972a4bedaaaba3
    ```

    This outputs the evaluation result along with the complete `input` object. You can pipe it through `jq` to explore the structure:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli evaluate trail \
      --policy snyk-no-high-vulns.rego \
      --org cyber-dojo \
      --flow dashboard-ci \
      --attestations dashboard.snyk-container-scan \
      --show-input \
      --output json \
      44ca5fa2630947cf375fdbda10972a4bedaaaba3 2>/dev/null | jq '.input.trail.compliance_status | keys'
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    [
      "artifacts_statuses",
      "attestations_statuses",
      "evaluated_at",
      "flow_template_id",
      "is_compliant",
      "status"
    ]
    ```

    <Info>
      Use the `--attestations` flag to limit which attestations are enriched with full detail. The flag filters by **attestation name** (not type). For example, `--attestations pull-request` fetches only details for attestations named `pull-request`, which speeds up evaluation and reduces noise when exploring the input.
    </Info>
  </Step>

  <Step title="Use in CI/CD">
    The `kosli evaluate` commands exit with `0` on allow and `1` on deny or error -- making them straightforward to use as pipeline gates. See the [Rego Policy reference](/policy-reference/rego_policy#exit-codes) for details on distinguishing denial from command failure.

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    # Example: gate a deployment on policy evaluation
    if kosli evaluate trail \
      --policy policies/pr-approved.rego \
      --org "$KOSLI_ORG" \
      --flow "$FLOW_NAME" \
      "$GIT_COMMIT"; then
      echo "Policy passed -- proceeding with deployment"
      # ... deploy commands ...
    else
      echo "Policy denied -- blocking deployment"
      exit 1
    fi
    ```

    This pattern lets you enforce custom compliance rules as part of your delivery pipeline, using the same trail data that Kosli already collects.
  </Step>

  <Step title="Record the evaluation">
    After evaluating a trail, you can record the result as an attestation. This creates an audit record in Kosli that captures the policy, the full evaluation report, and any violations.

    This step requires write access to your Kosli org. The examples below use variables you'd set in your CI/CD pipeline. In your own pipeline you'd use your own policy file -- here we use `my-policy.rego` as a placeholder:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    # Run the evaluation and save the full JSON report to a file
    # (|| true prevents the step from failing when the policy denies)
    kosli evaluate trail "$TRAIL_NAME" \
      --policy my-policy.rego \
      --org "$KOSLI_ORG" \
      --flow "$FLOW_NAME" \
      --show-input \
      --output json > eval-report.json 2>/dev/null || true

    # Read the allow/deny result from the report
    is_compliant=$(jq --raw-output '.allow' eval-report.json)

    # Extract violations as structured user-data
    jq '{violations: .violations}' eval-report.json > eval-violations.json

    # Attest the result
    kosli attest generic \
      --name opa-evaluation \
      --flow "$FLOW_NAME" \
      --trail "$TRAIL_NAME" \
      --org "$KOSLI_ORG" \
      --compliant="$is_compliant" \
      --attachments my-policy.rego,eval-report.json \
      --user-data eval-violations.json
    ```

    This creates a generic attestation on the trail with:

    * **`--compliant`** set based on whether the policy allowed or denied -- read directly from the JSON report rather than relying on the exit code, which avoids issues with `set -e` in CI environments like GitHub Actions
    * **`--attachments`** containing the Rego policy (for reproducibility) and the full JSON evaluation report (including the input data the policy evaluated)
    * **`--user-data`** containing the violations, which appear in the Kosli UI as structured metadata on the attestation

    <Warning>
      Use `--compliant=value` (with `=`) not `--compliant value` (with a space). Boolean flags in Kosli CLI require the `=` syntax when passing `false` -- otherwise `false` is interpreted as a positional argument.
    </Warning>
  </Step>
</Steps>

## What you've accomplished

You have written OPA/Rego policies using the three design rules that prevent false-positive compliance results: fail-safe default, compliance via positive assertion, and violations as diagnostics only. You've evaluated Kosli trails against those policies, tested safety properties locally with `kosli evaluate input`, and recorded evaluation results as attestations.

From here you can:

* Explore evaluated trails in the [Kosli app](https://app.kosli.com)
* Gate deployments in CI/CD pipelines using `kosli evaluate trail` exit codes
* Use environment-specific params files to enforce different thresholds per environment
* Extend your policies to check other attestation types. See [`kosli evaluate trail`](/client_reference/kosli_evaluate_trail) and [`kosli evaluate trails`](/client_reference/kosli_evaluate_trails) for the full flag reference


# From commit to production
Source: https://docs.kosli.com/tutorials/following_a_git_commit_to_runtime_environments

In this 5 minute tutorial you'll learn how Kosli tracks "life after git" and shows you events from CI pipelines (eg, building the docker image, running the unit tests, deploying, etc) and runtime environments (eg, the blue-green rollover, instance scaling, etc)

We will follow an actual git commit from a CI pipeline all the way into production runtime environments.
By the end, you will have queried Kosli to see an artifact's history — from creation in CI through running in production to eventual shutdown — without any access to the production environment.

We will use **cyber-dojo**, an open-source microservice platform whose Kosli data is public.
The commit we follow fixed a misconfiguration: `runner` should run with three replicas but was accidentally running with one after a migration from GKE to ECS.

<Info>
  [cyber-dojo](https://cyber-dojo.org) is a web platform where teams practice TDD. It has a dozen microservices, each with its own GitHub Actions CI pipeline producing a Docker image, running in two AWS environments: `aws-beta` and `aws-prod`.
</Info>

## Prerequisites

* [Install Kosli CLI](/getting_started/install).
* [Get a Kosli API token](/getting_started/authenticating_to_kosli).

## Setup

Set your environment variables to use the public `cyber-dojo` Kosli organization:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
export KOSLI_API_TOKEN=<your-api-token>
```

## List flows

Find out which `cyber-dojo` repositories have a CI pipeline reporting to Kosli:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list flows
```

You will see:

```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
NAME                        DESCRIPTION                                               VISIBILITY  TAGS
creator-ci                  UX for Group/Kata creation                                private     [ci=github], [repo_url=https://github.com/cyber-dojo/creator], [kind=build], [env=aws-beta]
custom-start-points-ci      Custom exercises choices                                  private     [env=aws-beta], [ci=github], [repo_url=https://github.com/cyber-dojo/custom-start-points], [kind=build]
dashboard-ci                UX for a group practice dashboard                         private     [ci=github], [repo_url=https://github.com/cyber-dojo/dashboard], [kind=build], [env=aws-beta]
differ-ci                   Diff files from two traffic-lights                        private     [env=aws-beta], [ci=github], [repo_url=https://github.com/cyber-dojo/differ], [kind=build]
differ-ci-tf                Terraform human-readable plan and state file fingerprint  private
docker-base-ci              Build cyber-dojo/docker-base image                        private
exercises-start-points-ci   Exercises choices                                         private     [ci=github], [repo_url=https://github.com/cyber-dojo/exercises-start-points], [kind=build], [env=aws-beta]
languages-start-points-ci   Language+TestFramework choices                            private     [ci=github], [repo_url=https://github.com/cyber-dojo/languages-start-points], [kind=build], [env=aws-beta]
nginx-ci                    Reverse proxy                                             private     [kind=build], [env=aws-beta], [ci=github], [repo_url=https://github.com/cyber-dojo/nginx]
production-promotion        Promotes sets of Artifacts from aws-beta to aws-prod      private     [ci=github], [repo_url=https://github.com/cyber-dojo/aws-prod-co-promotion], [kind=release], [env=aws-prod]
production-server-access    Flow to track production server access                    private
runner-ci                   Test runner                                               private     [ci=github], [repo_url=https://github.com/cyber-dojo/runner], [kind=build], [env=aws-beta]

...some output elided...
```

## Follow the artifact

The commit that fixed the replica count was [16d9990](https://github.com/cyber-dojo/runner/commit/16d9990ad23a40eecaf087abac2a58a2d2a4b3f4) in the `runner` repository. Fetch its history from Kosli with `kosli search`, which accepts a git commit (full or short-form) or an artifact fingerprint:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli search 16d9990
```

You will see:

```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
Search result resolved to commit 16d9990ad23a40eecaf087abac2a58a2d2a4b3f4
Name:              cyberdojo/runner:16d9990
Fingerprint:       9af401c4350b21e3f1df17d6ad808da43d9646e75b6da902cc7c492bcfb9c625
Has provenance:    true
Flow:              runner-archived-at-1709658802
Git commit:        16d9990ad23a40eecaf087abac2a58a2d2a4b3f4
Commit URL:        https://github.com/cyber-dojo/runner/commit/16d9990ad23a40eecaf087abac2a58a2d2a4b3f4
Build URL:         https://github.com/cyber-dojo/runner/actions/runs/2902808452
Artifact URL:      https://app.kosli.com/cyber-dojo/flows/runner-archived-at-1709658802/artifacts/9af401c4350b21e3f1df17d6ad808da43d9646e75b6da902cc7c492bcfb9c625
Compliance state:  COMPLIANT
Running in:        [  ]
Exited from:       [ aws-beta, aws-prod ]
History:
    Artifact created                               Mon, 22 Aug 2022 11:35:00 CEST
    Started running in aws-beta#84 environment     Mon, 22 Aug 2022 11:38:28 CEST
    Started running in aws-prod#65 environment     Mon, 22 Aug 2022 11:39:22 CEST
    No longer running in aws-beta#119 environment  Wed, 24 Aug 2022 18:05:42 CEST
    No longer running in aws-prod#96 environment   Wed, 24 Aug 2022 18:12:28 CEST
```

<Info>
  When this commit was made, the runner repository reported to a flow simply named `runner`. cyber-dojo's flows have since been reorganized (today the repository reports to `runner-ci`, as the flow list above shows) and the original flows archived. Archiving a flow currently renames it by appending `-archived-at-<timestamp>`, which is why the historical evidence displays the longer name.
</Info>

The **History** shows the artifact's lifecycle: created by CI, running in both environments, and eventually replaced by a newer version. `Has provenance: true` means the artifact was reported to Kosli by a CI pipeline, so its build history is known. The compliance state `COMPLIANT` means all required evidence was provided before deployment.

The same information is available in the [Kosli web interface](https://app.kosli.com/cyber-dojo/flows/runner-archived-at-1709658802/artifacts/9af401c4350b21e3f1df17d6ad808da43d9646e75b6da902cc7c492bcfb9c625).

## Inspect the environment snapshot

The History shows the artifact started running in snapshot `aws-prod#65`. Query that snapshot to see everything running in production at that moment:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get snapshot aws-prod#65
```

The output will be:

```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
COMMIT   ARTIFACT                                                                              FLOW                                           COMPLIANCE  RUNNING_SINCE  REPLICAS
16d9990  Name: 274425519734.dkr.ecr.eu-central-1.amazonaws.com/runner:16d9990                  runner-archived-at-1709658802                  COMPLIANT   2022-08-22     3
         Fingerprint: 9af401c4350b21e3f1df17d6ad808da43d9646e75b6da902cc7c492bcfb9c625

7c45272  Name: 274425519734.dkr.ecr.eu-central-1.amazonaws.com/shas:7c45272                    shas-archived-at-1705491385                    COMPLIANT   2022-08-22  1
         Fingerprint: 76c442c04283c4ca1af22d882750eb960cf53c0aa041bbdb2db9df2f2c1282be

...some output elided...

85d83c6  Name: 274425519734.dkr.ecr.eu-central-1.amazonaws.com/runner:85d83c6                  runner-archived-at-1709658802                  COMPLIANT   2022-08-20  1
         Fingerprint: eeb0cfc9ee7f69fbd9531d5b8c1e8d22a8de119e2a422344a714a868e9a8bfec

1a2b170  Name: 274425519734.dkr.ecr.eu-central-1.amazonaws.com/differ:1a2b170                  differ-archived-at-1707630536                  COMPLIANT   2022-08-20  1
         Fingerprint: d8440b94f7f9174c180324ceafd4148360d9d7c916be2b910f132c58b8a943ae
```

You can see `runner:16d9990` is running with 3 replicas — the fix worked. You also notice two versions of `runner` running simultaneously: this is a blue-green deployment in progress. `runner:85d83c6` (the old version, 1 replica) will be stopped in the next snapshot.

## Diff two snapshots

To see exactly what changed between snapshots `aws-prod#64` and `aws-prod#65`:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli diff snapshots aws-prod#64 aws-prod#65
```

The response will be:

```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
Only present in aws-prod#65

     Name:         274425519734.dkr.ecr.eu-central-1.amazonaws.com/runner:16d9990
     Fingerprint:  9af401c4350b21e3f1df17d6ad808da43d9646e75b6da902cc7c492bcfb9c625
     Flow:         runner-archived-at-1709658802
     Commit URL:   https://github.com/cyber-dojo/runner/commit/16d9990ad23a40eecaf087abac2a58a2d2a4b3f4
     Started:      Mon, 22 Aug 2022 11:39:17 CEST • 2022-08-22
     Instances:    3
```

This confirms that `runner:16d9990` is the only new artifact in snapshot 65 — exactly the commit that fixed the replica count.

## What you've accomplished

You have traced a git commit from its creation in CI through deployment and into production, querying its compliance state, runtime replicas, and the exact moment it appeared in the environment — all without any direct access to `aws-prod`.

From here you can:

* Explore more of cyber-dojo's data at [app.kosli.com/cyber-dojo](https://app.kosli.com/cyber-dojo)
* Learn how to report your own environments with [`kosli snapshot`](/client_reference/kosli_snapshot_k8s)
* Set up your own flows and trails with the [Getting started guide](/getting_started/flows)


# Linking trails across branches
Source: https://docs.kosli.com/tutorials/linking_trails_across_branches

How to connect compliance evidence from PR trails to main-branch trails in Kosli.

Many teams run compliance checks — tests, security scans, code review — during a pull request build and want to carry that evidence forward when the code merges into the main branch. Because each build typically creates its own Kosli trail, the question arises: **how do you prove on the main-branch trail that the PR-branch checks already passed?**

This guide explains the problem, the recommended workaround today, and the risks to be aware of.

## The problem

A typical CI workflow uses two Kosli flows:

| Flow       | Triggered by        | Trail name                 | What it records                     |
| ---------- | ------------------- | -------------------------- | ----------------------------------- |
| `app-pr`   | Pull request builds | PR number or branch commit | Tests, scans, code review           |
| `app-main` | Merges to main      | Merge commit SHA           | Artifact build, deployment approval |

After a PR merges, the main-branch build produces the release artifact. But the compliance evidence (tests, scans) lives on the PR trail in a different flow. Kosli does not yet have a built-in way to formally link one trail to another.

## Recommended approach

Use `kosli evaluate trail` on the main-branch build to evaluate the PR trail against a Rego policy, then record the result as an attestation on the main trail.

<Steps>
  <Step title="Identify the PR trail name from the main build">
    Derive the PR trail name from information available in your main-branch CI context. Common strategies:

    * **Git ancestry** — find the merge commit's parent that matches a PR trail name.
    * **Branch naming convention** — extract the PR number from the merge commit message (e.g. `Merge pull request #42`).
    * **CI environment variables** — some CI systems expose the originating PR number on merge builds.

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    # Example: extract PR number from a GitHub merge commit message
    PR_NUMBER=$(git log -1 --format='%s' | grep -oP '#\K[0-9]+')
    PR_TRAIL="PR-${PR_NUMBER}"
    ```
  </Step>

  <Step title="Check the PR trail compliance">
    There are two ways to check the PR trail's compliance. Use `kosli evaluate trail` with a Rego policy for a formal, policy-driven check that fails the CI step automatically. Alternatively, use `kosli get trail` with JSON output for a lighter approach that does not require a policy file.

    <Tabs>
      <Tab title="evaluate trail (Rego policy)">
        Use `kosli evaluate trail` to check the PR trail against a Rego policy. Create a policy file (e.g. `pr-compliant.rego`):

        ```rego pr-compliant.rego theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        package main

        default allow = false

        allow {
          input.trail.compliance.is_compliant == true
        }
        ```

        Then evaluate the PR trail:

        ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        kosli evaluate trail "$PR_TRAIL" \
          --flow app-pr \
          --policy pr-compliant.rego
        ```

        The command exits with a non-zero code if the trail does not satisfy the policy, which fails the CI step automatically.
      </Tab>

      <Tab title="get trail (JSON + jq)">
        Use `kosli get trail` with JSON output and parse the compliance status:

        ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        IS_COMPLIANT=$(kosli get trail "$PR_TRAIL" \
          --flow app-pr \
          --output json | jq -r '.compliance.is_compliant')
        ```

        This is simpler but does not use a formal policy. You will need `$IS_COMPLIANT` in the next step.
      </Tab>
    </Tabs>
  </Step>

  <Step title="Attest the result on the main trail">
    Record a generic attestation on your main-branch trail with the PR trail's compliance result.

    <Tabs>
      <Tab title="evaluate trail (Rego policy)">
        Because `kosli evaluate trail` fails the CI step on a non-compliant trail, this attestation only runs when the trail is compliant:

        ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        kosli attest generic \
          --name pr-build-compliance \
          --flow app-main \
          --trail "$(git rev-parse HEAD)" \
          --compliant=true \
          --description "PR trail ${PR_TRAIL} in flow app-pr passed policy evaluation"
        ```
      </Tab>

      <Tab title="get trail (JSON + jq)">
        Pass the `$IS_COMPLIANT` value from the previous step:

        ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
        kosli attest generic \
          --name pr-build-compliance \
          --flow app-main \
          --trail "$(git rev-parse HEAD)" \
          --compliant="$IS_COMPLIANT" \
          --description "PR trail ${PR_TRAIL} in flow app-pr was compliant: ${IS_COMPLIANT}"
        ```
      </Tab>
    </Tabs>

    Add `pr-build-compliance` to your main flow's template so that missing evidence is flagged:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    # yaml-language-server: $schema=https://docs.kosli.com/schemas/flow-template/v1.json
    version: 1
    trail:
      attestations:
      - name: pr-build-compliance
        type: generic
      artifacts:
      - name: app
        attestations:
        - name: artifact-build
          type: generic
    ```
  </Step>
</Steps>

## Risks and considerations

This approach works, but carries assumptions you should evaluate for your environment:

### Code equivalence between PR and main

A PR build runs against the branch head at build time. Between the PR build and the merge to main, the main branch may have received other commits. If the merge is not a **fast-forward**, the code on main after the merge may differ from what the PR build tested.

Mitigations:

* **Require linear history** in your repository settings (GitHub, GitLab, Bitbucket all support this). This forces rebasing before merge, ensuring the PR build tested the exact code that lands on main.
* **Require up-to-date branches** before merging, so the PR build always includes the latest main-branch changes.
* **Re-run critical tests on main** if fast-forward merges are not practical. This adds time but removes ambiguity.

<Warning>
  Without one of these mitigations, a PR trail's compliance does not guarantee that the merged code on main behaves identically. Evaluate whether this risk is acceptable for your compliance requirements.
</Warning>

### Binary reproducibility

If your build process is not reproducible, the artifact built on main may differ from the one built on the PR branch — even from identical source code. In that case, the PR trail's attestations apply to a different artifact than the one you deploy.

If your builds are reproducible, you can strengthen the link by verifying that the artifact fingerprint on main matches one attested in the PR trail.

### Trust boundaries

The approach above relies on the Kosli API token used in CI having read access to the PR flow. Ensure your CI secrets and permissions are configured so that:

* The main-branch build can query `app-pr` trails.
* Only authorized pipelines can write attestations to `app-main`.

## Example: GitHub Actions

Below is a simplified GitHub Actions workflow for a main-branch build that links back to the PR trail:

<Tabs>
  <Tab title="evaluate trail (Rego policy)">
    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    name: Main build
    on:
      push:
        branches: [main]

    jobs:
      build:
        runs-on: ubuntu-latest
        steps:
          - uses: actions/checkout@v7
            with:
              fetch-depth: 2

          - name: Identify PR trail
            id: pr
            run: |
              PR_NUMBER=$(git log -1 --format='%s' | grep -oP '#\K[0-9]+' || echo "")
              echo "trail=PR-${PR_NUMBER}" >> "$GITHUB_OUTPUT"
              echo "found=${PR_NUMBER:+true}" >> "$GITHUB_OUTPUT"

          - name: Begin trail
            run: |
              kosli begin trail "$(git rev-parse HEAD)" \
                --flow app-main

          - name: Build artifact
            run: docker build -t myapp:latest .

          - name: Attest artifact
            run: |
              kosli attest artifact myapp:latest \
                --artifact-type docker \
                --name app \
                --flow app-main \
                --trail "$(git rev-parse HEAD)"

          - name: Evaluate PR trail compliance
            if: steps.pr.outputs.found == 'true'
            run: |
              kosli evaluate trail "${{ steps.pr.outputs.trail }}" \
                --flow app-pr \
                --policy pr-compliant.rego

              kosli attest generic \
                --name pr-build-compliance \
                --flow app-main \
                --trail "$(git rev-parse HEAD)" \
                --compliant=true \
                --description "PR trail ${{ steps.pr.outputs.trail }} passed policy evaluation"
    ```
  </Tab>

  <Tab title="get trail (JSON + jq)">
    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    name: Main build
    on:
      push:
        branches: [main]

    jobs:
      build:
        runs-on: ubuntu-latest
        steps:
          - uses: actions/checkout@v7
            with:
              fetch-depth: 2

          - name: Identify PR trail
            id: pr
            run: |
              PR_NUMBER=$(git log -1 --format='%s' | grep -oP '#\K[0-9]+' || echo "")
              echo "trail=PR-${PR_NUMBER}" >> "$GITHUB_OUTPUT"
              echo "found=${PR_NUMBER:+true}" >> "$GITHUB_OUTPUT"

          - name: Begin trail
            run: |
              kosli begin trail "$(git rev-parse HEAD)" \
                --flow app-main

          - name: Build artifact
            run: docker build -t myapp:latest .

          - name: Attest artifact
            run: |
              kosli attest artifact myapp:latest \
                --artifact-type docker \
                --name app \
                --flow app-main \
                --trail "$(git rev-parse HEAD)"

          - name: Check PR trail compliance
            if: steps.pr.outputs.found == 'true'
            run: |
              IS_COMPLIANT=$(kosli get trail "${{ steps.pr.outputs.trail }}" \
                --flow app-pr \
                --output json | jq -r '.compliance.is_compliant')

              kosli attest generic \
                --name pr-build-compliance \
                --flow app-main \
                --trail "$(git rev-parse HEAD)" \
                --compliant="$IS_COMPLIANT" \
                --description "PR trail ${{ steps.pr.outputs.trail }} was compliant: ${IS_COMPLIANT}"
    ```
  </Tab>
</Tabs>

## Looking ahead

Kosli is exploring native support for linking trails across flows — removing the need for the scripted approach described above. When available, this will allow you to declare trail dependencies directly in the flow template, with Kosli resolving and evaluating the linked trail's compliance automatically.

Until then, the `kosli evaluate trail` approach described here is the recommended pattern.


# Organizing Flows and Environments with Spaces
Source: https://docs.kosli.com/tutorials/organizing_with_spaces

Learn how to use Kosli Spaces to hierarchically organize your Flows and Environments

## Introduction

Spaces addresses a scaling challenge facing large organizations as they attempt to fully automate software delivery governance. Ingesting large amounts of data from hundreds of sources — CI/CD pipelines, security scanners, test frameworks, deployment tools — means that it becomes increasingly difficult for different stakeholders to access the information they need.

Kosli Spaces allows users to:

* Create nested organizational structures
* Organize flows and environments hierarchically without disrupting artifact traceability
* Navigate complex resource relationships through an intuitive hierarchical interface
* Prepare for future enterprise features like hierarchical access control

Spaces work like directories in a file system — they can contain resources and other Spaces, creating a flexible tree structure that reflects how your organization actually works.

## Architectural Overview

### How to Use Spaces in Your Organization

Spaces allow you to model your organizational structure within Kosli. Think of them as containers that can hold:

* **Kosli resources**: Flows and Environments
* **Other Spaces**: Create nested hierarchies that match your organizational structure

A typical organizational hierarchy might look like this:

```
Acme Bank
├── Space: Investment Banking
│   └── Space: Trading Systems
│       └── Space: Equity Trading
│           └── Space: Trade Execution Platform
│               ├── Flow: trade-execution-ci
│               └── Environment: equity-prod
└── Space: Technology Services
    └── Space: Platform Engineering
        └── Space: DevOps
            ├── Flow: infrastructure-ci
            └── Environment: k8s-prod
```

In this structure:

* **Acme Bank** is the organization, also referred to as the "root space"
* **Investment Banking** and **Technology Services** are major divisions represented by Spaces
* Each division contains business units (Trading Systems, Platform Engineering), also represented by nested spaces
* **Trade Execution Platform** and **DevOps** are a project and a team, also nested spaces within the business units
* Flows and Environments are placed in Spaces that reflect their team ownership

### Who Can Use Spaces?

Spaces is available to every organization, and to all users within an organization. All users can:

* Navigate through the Space hierarchy
* View resources within a Space

Only administrators of an organization have the ability to manage and create spaces.

## Getting Started

To begin using Spaces:

1. Review your current organizational structure
2. Identify logical groupings for your Flows and Environments and map them to spaces
3. Organize flows and Environments according to the design
4. New and existing Flows and Environments will be under the organization Root until they are moved to a space

## Using Spaces

### Navigating the Hierarchy

Access the Space hierarchy from the link in the left navigation. The hierarchy displays as an interactive tree structure, similar to a file system, showing all your Spaces and the resources they contain.

To make changes to the spaces, click the manage spaces button. Changes will only be saved when clicking the "Save Changes" button.

**Key navigation features:**

* **Tree view**: See your entire organizational structure at a glance
* **Resource visibility**: Each Space shows the Flows and Environments it contains
* **Filter controls**: Use toggle buttons to show or hide Flows and Environments for a cleaner view
* **Text filtering**: The search filter can help you quickly locate specific Spaces or resources
* **Collapsing spaces**: Use the caret icon to collapse or expand the contents of specific spaces

### Creating Spaces

To create a new space:

1. Enter edit mode by clicking the "manage spaces" button
2. Right-click on the three dots icon of the root organization or any existing Space to open the contextual menu
3. Select "Create nested space"
4. Enter a name for your new Space
5. The Space is created and appears in the hierarchy view

You can create Spaces at any level in the hierarchy to match your organizational structure.

### Moving Resources Between Spaces

The Spaces management view supports drag-and-drop operations for reorganizing your Spaces and resources.

**Moving individual items:**

1. Click and drag a Space or resource from its current location
2. Drop it onto the target Space where you want it to live

**Batch moving multiple items:**

1. Use the checkboxes to select multiple Spaces and/or resources
2. Drag the selected items onto the target Space
3. All selected items will move to the new location

**Important notes:**

* Moving a Space moves all of its contents (nested Spaces and resources)
* You can only move resources and Spaces to valid locations (no circular references)

### Deleting Spaces

Spaces can only be deleted when they are empty — all resources and nested Spaces must be moved out first.

**To delete a Space:**

**Option 1 - Contextual menu:**

1. Right-click on the empty Space
2. Select "Delete" from the contextual menu

**Option 2 - Checkbox selection:**

1. Select one or more empty Spaces using their checkboxes
2. Click the bin icon in the toolbar

### Viewing All Resources for a Space

To work with resources in a specific Space:

1. Navigate to the Environments or Flows page from the main navigation
2. Use the Space dropdown selector to choose which Space you want to view
3. The page will display only the resources belonging to that Space and its descendant Spaces

## Feature Roadmap

This initial release of Spaces establishes the foundation for hierarchical organization in Kosli. Here is what will be coming next:

1. **Hierarchical Permissions**
   * Current state: All users can see all Spaces within the organization
   * Future: Fine-grained access control allowing you to restrict visibility and access based on Space membership

2. **Concurrent Editing Protection**
   * Current state: Multiple users editing the Space structure simultaneously may overwrite each other's changes
   * Future: Conflict detection and resolution mechanisms to prevent unintended overwrites

3. **Programmatic management of Spaces**
   * Current state: Spaces can only be managed via the UI in [https://app.kosli.com](https://app.kosli.com)
   * Future: CLI commands and APIs will be available to manage spaces programmatically

4. **Space Deletion**
   * Current state: only empty spaces can be deleted
   * Future: Users will be prompted to decide what to do with contents of a space before deleting it

For questions or support, please contact the Kosli team.


# Querying Kosli
Source: https://docs.kosli.com/tutorials/querying_kosli

This tutorial shows you how to use Kosli's query commands to search for artifacts, inspect their history, and browse runtime environment snapshots.

`get`, `list`, `log`, and `diff` commands let you query everything Kosli knows about your artifacts and environments directly from your terminal.
By the end of this tutorial, you will have searched for an artifact by commit SHA, inspected its full history, browsed environment snapshots, and compared two snapshots to see what changed.

We will query **cyber-dojo**, an open-source project whose Kosli data is public.

## Prerequisites

* [Install Kosli CLI](/getting_started/install).
* [Get a Kosli API token](/getting_started/authenticating_to_kosli).

## Setup

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
export KOSLI_API_TOKEN=<your-api-token>
```

## Search by commit SHA

If you have a git commit SHA, `kosli search` will find any artifact built from it:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli search 0f5c9e1
```

```
Search result resolved to commit 0f5c9e19c4d4f948d19ce4c8495b2a44745cda96
Name:              cyberdojo/web:0f5c9e1
Fingerprint:       62e1d2909cc59193b31bfd120276fcb8ba5e42dd6becd873218a41e4ce022505
Has provenance:    true
Flow:              web
Git commit:        0f5c9e19c4d4f948d19ce4c8495b2a44745cda96
Commit URL:        https://github.com/cyber-dojo/web/commit/0f5c9e19c4d4f948d19ce4c8495b2a44745cda96
Build URL:         https://github.com/cyber-dojo/web/actions/runs/3021563461
Compliance state:  COMPLIANT
History:
    Artifact created                                   Fri, 09 Sep 2022 11:59:50 CEST
    Deployment #59 to aws-beta environment             Fri, 09 Sep 2022 12:01:12 CEST
    Started running in aws-beta#217 environment        Fri, 09 Sep 2022 12:02:42 CEST
    Deployment #60 to aws-prod environment             Fri, 09 Sep 2022 12:06:37 CEST
    Started running in aws-prod#202 environment        Fri, 09 Sep 2022 12:07:28 CEST
    Scaled up from 1 to 3 in aws-prod#203 environment  Fri, 09 Sep 2022 12:08:28 CEST
    No longer running in aws-beta#222 environment      Sat, 10 Sep 2022 08:44:42 CEST
    No longer running in aws-prod#210 environment      Sat, 10 Sep 2022 08:49:28 CEST
```

## List flows and artifacts

The search result tells us this artifact belongs to the `web` flow. If you don't know which flows exist in your org, you can list them all:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list flows
```

```
NAME                    DESCRIPTION                         VISIBILITY
creator                 UX for Group/Kata creation          public
custom-start-points     Custom exercises choices            public
dashboard               UX for a group practice dashboard   public
differ                  Diff files from two traffic-lights  public
exercises-start-points  Exercises choices                   public
languages-start-points  Language+TestFramework choices      public
nginx                   Reverse proxy                       public
repler                  REPL for Python images              public
runner                  Test runner                         public
saver                   Group/Kata model+persistence        public
shas                    UX for git+image shas               public
web                     UX for practicing TDD               public
```

Once you know the flow name, you can list the artifacts reported to it:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list artifacts --flow creator
```

```
COMMIT   ARTIFACT                                  STATE       CREATED_AT
344430d  Name: cyberdojo/creator:344430d           COMPLIANT   Wed, 14 Sep 2022 10:48:09 CEST
         Fingerprint: 817a72(...)6b5a273399c693

41bfb7b  Name: cyberdojo/creator:41bfb7b           COMPLIANT   Sat, 10 Sep 2022 08:41:15 CEST
         Fingerprint: 8d6fef(...)b84c281f712ef8

aa0a3d3  Name: cyberdojo/creator:aa0a3d3           COMPLIANT   Fri, 09 Sep 2022 11:58:56 CEST
         Fingerprint: 3ede07(...)238845a631e96a
[...]
```

By default, the last 15 artifacts are shown. Use <Tooltip>-n</Tooltip> to change how many are shown, <Tooltip>--page</Tooltip> to paginate, and <Tooltip>--output</Tooltip> to change the format.

## Get an artifact

The artifact list gives you commit SHAs and fingerprints. Use either to fetch the full history of a specific artifact — the syntax is <Tooltip>flow:sha or flow\@fingerprint</Tooltip>:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get artifact creator:344430d
```

```
Name:                     cyberdojo/creator:344430d
Flow:                     creator
Fingerprint:              817a72609041c51cd2a3bbbcbeb048c687677986b5a273399c6938b5e6aa1ded
Created on:               Wed, 14 Sep 2022 10:48:09 CEST • 2 months ago
Git commit:               344430d530d26068aa1f39760a9c094c989382f3
Commit URL:               https://github.com/cyber-dojo/creator/commit/344430d530d26068aa1f39760a9c094c989382f3
Build URL:                https://github.com/cyber-dojo/creator/actions/runs/3051390570
State:                    COMPLIANT
Running in environments:  aws-beta#265, aws-prod#259
History:
    Artifact created                               Wed, 14 Sep 2022 10:48:09 CEST
    branch-coverage evidence received              Wed, 14 Sep 2022 10:49:11 CEST
    Deployment #100 to aws-beta environment        Wed, 14 Sep 2022 10:50:40 CEST
    Deployment #101 to aws-prod environment        Wed, 14 Sep 2022 10:51:43 CEST
    Started running in aws-beta#229 environment    Wed, 14 Sep 2022 10:52:42 CEST
    Started running in aws-prod#217 environment    Wed, 14 Sep 2022 10:53:28 CEST
    ...
```

## Browse environment snapshots

The artifact history shows it was deployed to `aws-beta` and `aws-prod`. To explore those environments, start by listing what Kosli knows about them:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list environments
```

```
NAME      TYPE  LAST REPORT                LAST MODIFIED
aws-beta  ECS   2022-10-30T14:51:42+01:00  2022-10-30T14:51:42+01:00
aws-prod  ECS   2022-10-30T14:51:28+01:00  2022-10-30T14:51:28+01:00
beta      K8S   2022-06-15T11:39:59+02:00  2022-06-15T11:39:59+02:00
prod      K8S   2022-06-15T11:40:01+02:00  2022-06-15T11:40:01+02:00
```

To browse the history of changes in an environment:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list snapshots aws-beta
```

```
SNAPSHOT  FROM                            TO                              DURATION
266       Wed, 19 Oct 2022 09:47:42 CEST  now                             11 days
265       Wed, 19 Oct 2022 09:46:42 CEST  Wed, 19 Oct 2022 09:47:42 CEST  59 seconds
264       Wed, 19 Oct 2022 09:45:42 CEST  Wed, 19 Oct 2022 09:46:42 CEST  about a minute
...
```

To see what was running in a specific snapshot:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get snapshot aws-beta#256
```

```
COMMIT   ARTIFACT                                                                              FLOW      RUNNING_SINCE  REPLICAS
6fe0d30  Name: 244531986313.dkr.ecr.eu-central-1.amazonaws.com/repler:6fe0d30                  N/A       16 days ago    1
         Fingerprint: a0c03099c832e4ce5f23f5e33dac9889c0b7ccd61297fffdaf1c67e7b99e6f8f

d90a3e4  Name: 244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:d90a3e4               N/A       16 days ago    1
         Fingerprint: dd5308fdcda117c1ff3963e192a069ae390c2fe9e10e8abfa2430224265efe98
[...]
```

You can also reference snapshots relatively — `aws-beta~1` means one behind the current snapshot, `aws-beta~19` means 19 behind.

## Compare snapshots

Now that you can see individual snapshots, you can also diff two of them to find out exactly what changed between any two points in time:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli diff snapshots aws-beta aws-beta~1
```

```
Only present in aws-beta (snapshot: aws-beta#266)

     Name:         244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:d90a3e4
     Fingerprint:  dd5308fdcda117c1ff3963e192a069ae390c2fe9e10e8abfa2430224265efe98
     Flow:         dashboard
     Commit URL:   https://github.com/cyber-dojo/dashboard/commit/d90a3e481d57023816f6694ba4252342889405eb
     Started:      Wed, 19 Oct 2022 09:47:33 CEST • 11 days ago
```

You can also diff two different environments to see what's running in one but not the other:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli diff snapshots aws-beta~3 aws-prod
```

## Don't parse the raw CLI output

The human-readable output you see above (tables, `COMPLIANT`/`NON-COMPLIANT` labels, history lines, etc.) is intended for people, not scripts. The exact wording, casing, and field labels may change between CLI versions to improve clarity or to stay aligned with the UI, and parsing this text in scripts or CI gates will silently break when it does.

If you need to act on Kosli data programmatically — for example, to fail a pipeline when an artifact is non-compliant — use one of the stable interfaces instead:

* **Exit codes.** Commands like `kosli assert` exit non-zero when the assertion fails, so you can branch on `$?` directly without parsing any output.
* **Structured output.** Pass `--output json` to any `get`, `list`, `search`, or `diff` command and read the documented JSON fields (e.g. `compliant`) rather than grepping the text rendering.

As a rule of thumb: if you're tempted to `grep COMPLIANT` or `grep NON-COMPLIANT` in a script, switch to the exit-code check or JSON field - it will keep working across CLI upgrades.

## What you've accomplished

You have searched for an artifact by commit SHA, inspected a flow's artifact list, fetched an artifact's full history, browsed environment snapshots, and diffed two snapshots to see exactly what changed.

From here you can:

* Learn more about [`kosli search`](/client_reference/kosli_search), [`kosli get artifact`](/client_reference/kosli_get_artifact), and [`kosli diff snapshots`](/client_reference/kosli_diff_snapshots) in the CLI reference
* See a real end-to-end example in the [From commit to production](/tutorials/following_a_git_commit_to_runtime_environments) tutorial


# Report AWS environments to Kosli
Source: https://docs.kosli.com/tutorials/report_aws_envs

Learn how to report running artifacts from ECS, Lambda, and S3 environments to Kosli — using the CLI for a quick test or a Terraform module for production.

By the end of this tutorial, you will have reported a snapshot of your AWS environment to Kosli, making its running artifacts visible and trackable.

There are two ways to do this:

* **Kosli CLI** — quick to run, suitable for testing only
* **<Tooltip href="https://registry.terraform.io/modules/kosli-dev/kosli-reporter/aws/latest">Kosli reporter Terraform module</Tooltip>** — deploys a <Tooltip>Lambda reporter</Tooltip> for continuous, production-grade reporting

Follow the section that matches your needs.

## Prerequisites

* Have access to AWS.
* [Create an ECS, Lambda, or S3 Kosli environment](/getting_started/environments#create-an-environment) named `aws-env-tutorial`.
* [Get a Kosli API token](/getting_started/authenticating_to_kosli).

## Report using Kosli CLI

This approach is suitable for testing only.

[Install Kosli CLI](/getting_started/install) if you have not done so, then export your AWS credentials:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export AWS_REGION=yourAWSRegion
export AWS_ACCESS_KEY_ID=yourAWSAccessKeyID
export AWS_SECRET_ACCESS_KEY=yourAWSSecretAccessKey
```

Run the snapshot command for your environment type:

<Tabs>
  <Tab title="ECS">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot ecs aws-env-tutorial \
        --cluster <your-ecs-cluster-name> \
        --api-token <your-api-token-here> \
        --org <your-kosli-org-name>
    ```
  </Tab>

  <Tab title="Lambda">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot lambda aws-env-tutorial \
        --function-names function1,function2 \
        --api-token <your-api-token-here> \
        --org <your-kosli-org-name>
    ```
  </Tab>

  <Tab title="S3">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot s3 aws-env-tutorial \
        --bucket <your-bucket-name> \
        --api-token <your-api-token-here> \
        --org <your-kosli-org-name>
    ```
  </Tab>
</Tabs>

## Report using Terraform module

[Install Terraform](https://developer.hashicorp.com/terraform/install) if you have not done so.

1. [Authenticate to AWS](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html).

2. Store your Kosli API token in <Tooltip>AWS SSM Parameter Store</Tooltip> as a `SecureString` parameter named `kosli_api_token`.

3. Create a `main.tf` file with the configuration for your environment type:

<Tabs>
  <Tab title="ECS">
    ```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    terraform {
      required_version = ">= 1.0.0"

      required_providers {
        aws = {
          source  = "hashicorp/aws"
          version = ">= 4.63"
        }
        random = {
          source  = "hashicorp/random"
          version = ">= 3.5.1"
        }
      }
    }

    provider "aws" {
      region = local.region

      # Make it faster by skipping some checks
      skip_metadata_api_check     = true
      skip_region_validation      = true
      skip_credentials_validation = true
      skip_requesting_account_id  = true
    }

    locals {
      reporter_name = "reporter-${random_pet.this.id}"
      region        = "eu-central-1"
    }

    data "aws_caller_identity" "current" {}

    data "aws_canonical_user_id" "current" {}

    resource "random_pet" "this" {
      length = 2
    }

    module "lambda_reporter" {
      source  = "kosli-dev/kosli-reporter/aws"
      version = "0.5.7"

      name                              = local.reporter_name
      kosli_environment_type            = "ecs"
      kosli_cli_version                 = "v2.11.0"
      kosli_environment_name            = "aws-env-tutorial"
      kosli_org                         = "<your-org-name>"
      reported_aws_resource_name        = "<your-ecs-cluster-name>"
    }
    ```
  </Tab>

  <Tab title="Lambda">
    ```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    terraform {
      required_version = ">= 1.0.0"

      required_providers {
        aws = {
          source  = "hashicorp/aws"
          version = ">= 4.63"
        }
        random = {
          source  = "hashicorp/random"
          version = ">= 3.5.1"
        }
      }
    }

    provider "aws" {
      region = local.region

      # Make it faster by skipping some checks
      skip_metadata_api_check     = true
      skip_region_validation      = true
      skip_credentials_validation = true
      skip_requesting_account_id  = true
    }

    locals {
      reporter_name = "reporter-${random_pet.this.id}"
      region        = "eu-central-1"
    }

    data "aws_caller_identity" "current" {}

    data "aws_canonical_user_id" "current" {}

    resource "random_pet" "this" {
      length = 2
    }

    variable "my_lambda_functions" {
      type    = string
      default = "function_name1, function_name2"
    }

    module "lambda_reporter" {
      source  = "kosli-dev/kosli-reporter/aws"
      version = "0.5.7"

      name                           = local.reporter_name
      kosli_environment_type         = "lambda"
      kosli_cli_version              = "v2.11.0"
      kosli_environment_name         = "aws-env-tutorial"
      kosli_org                      = "<your-org-name>"
      reported_aws_resource_name     = var.my_lambda_functions
      use_custom_eventbridge_pattern = true
      custom_eventbridge_pattern     = local.custom_event_pattern
    }

    locals {
      lambda_function_names_list = split(",", var.my_lambda_functions)

      custom_event_pattern = jsonencode({
        source      = ["aws.lambda"]
        detail-type = ["AWS API Call via CloudTrail"]
        detail = {
          requestParameters = {
            functionName = local.lambda_function_names_list
          }
          responseElements = {
            functionName = local.lambda_function_names_list
          }
        }
      })
    }
    ```
  </Tab>

  <Tab title="S3">
    ```hcl theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    terraform {
      required_version = ">= 1.0.0"

      required_providers {
        aws = {
          source  = "hashicorp/aws"
          version = ">= 4.63"
        }
        random = {
          source  = "hashicorp/random"
          version = ">= 3.5.1"
        }
      }
    }

    provider "aws" {
      region = local.region

      # Make it faster by skipping some checks
      skip_metadata_api_check     = true
      skip_region_validation      = true
      skip_credentials_validation = true
      skip_requesting_account_id  = true
    }

    locals {
      reporter_name = "reporter-${random_pet.this.id}"
      region        = "eu-central-1"
    }

    data "aws_caller_identity" "current" {}

    data "aws_canonical_user_id" "current" {}

    resource "random_pet" "this" {
      length = 2
    }

    module "lambda_reporter" {
      source  = "kosli-dev/kosli-reporter/aws"
      version = "0.5.7"

      name                       = local.reporter_name
      kosli_environment_type     = "s3"
      kosli_cli_version          = "v2.11.0"
      kosli_environment_name     = "aws-env-tutorial"
      kosli_org                  = "<your-org-name>"
      reported_aws_resource_name = "<your-s3-bucket-name>"
    }
    ```
  </Tab>
</Tabs>

4. Initialize and apply the Terraform configuration:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
terraform init
terraform apply
```

5. To verify the Lambda reporter is running, go to the AWS console → Lambda → your reporter function → Monitor → Logs.

## What you've accomplished

You have reported a snapshot of your AWS environment to Kosli. Kosli now tracks the running artifacts in that environment and will record changes as they happen.

From here you can:

* Query your environment with [`kosli list snapshots`](/client_reference/kosli_list_snapshots) and [`kosli get snapshot`](/client_reference/kosli_get_snapshot)
* [Compare snapshots to see what changed](/client_reference/kosli_diff_snapshots)
* Trace a running artifact back to its git commit with the [From commit to production](/tutorials/following_a_git_commit_to_runtime_environments) tutorial


# Report Cloud Run environments to Kosli
Source: https://docs.kosli.com/tutorials/report_cloud_run_envs

Learn how to report running artifacts from a Google Cloud Run project and region to Kosli — using the CLI for a quick test or a scheduled Cloud Run Job for production.

By the end of this tutorial, you will have reported a snapshot of your Cloud Run environment to Kosli, making its running services and jobs visible and trackable.

`kosli snapshot cloud-run` covers a specific set of GCP deploy methods. See the [`kosli snapshot cloud-run`](/client_reference/kosli_snapshot_cloud-run) reference for the current list of what's supported.

There are two ways to do this:

* **Kosli CLI** — quick to run, suitable for testing only
* **<Tooltip>Scheduled Cloud Run Job</Tooltip>** — runs the reporter inside GCP on a schedule for continuous, production-grade reporting

Follow the section that matches your needs.

## Prerequisites

* Have access to a Google Cloud project and region with Cloud Run resources.
* [Create a Cloud Run Kosli environment](/getting_started/environments#create-an-environment) named `cloud-run-tutorial`.
* [Get a Kosli API token](/getting_started/authenticating_to_kosli).

## Report using Kosli CLI

This approach is suitable for testing only.

[Install Kosli CLI](/getting_started/install) if you have not done so, then authenticate to GCP with Application Default Credentials:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
gcloud auth application-default login
```

Run the snapshot command:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli snapshot cloud-run cloud-run-tutorial \
    --project <your-gcp-project> \
    --region <your-gcp-region> \
    --resolve-names \
    --api-token <your-api-token-here> \
    --org <your-kosli-org-name>
```

`--resolve-names` makes Cloud Run services display their image tags (for example the commit SHA) instead of bare digests by reverse-resolving the deployed digest against Artifact Registry. The forward digest lookup for tag-pinned Jobs runs automatically whether you pass the flag or not.

See [`kosli snapshot cloud-run`](/client_reference/kosli_snapshot_cloud-run) for the full flag reference.

## Report using a scheduled Cloud Run Job

For production, run the reporter inside GCP as a Cloud Run Job triggered by Cloud Scheduler.

<Steps>
  <Step title="Create a service account for the reporter">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    gcloud iam service-accounts create kosli-reporter \
        --display-name="Kosli reporter" \
        --project=<your-gcp-project>
    ```
  </Step>

  <Step title="Grant the reporter project-level access to Cloud Run">
    `roles/run.viewer` is the minimum needed to list services and jobs in the project.

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    gcloud projects add-iam-policy-binding <your-gcp-project> \
        --member="serviceAccount:kosli-reporter@<your-gcp-project>.iam.gserviceaccount.com" \
        --role="roles/run.viewer"
    ```
  </Step>

  <Step title="Store the Kosli API token in Secret Manager">
    Create a secret and add your token as the first version:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    gcloud secrets create kosli-api-token \
        --replication-policy=automatic \
        --project=<your-gcp-project>

    printf "<your-api-token-here>" | gcloud secrets versions add kosli-api-token \
        --data-file=- \
        --project=<your-gcp-project>
    ```

    Grant the reporter service account read access to that specific secret:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    gcloud secrets add-iam-policy-binding kosli-api-token \
        --member="serviceAccount:kosli-reporter@<your-gcp-project>.iam.gserviceaccount.com" \
        --role="roles/secretmanager.secretAccessor" \
        --project=<your-gcp-project>
    ```
  </Step>

  <Step title="Grant Artifact Registry read access">
    Grant `roles/artifactregistry.reader` to the reporter on each Artifact Registry repository that holds your application images. This is what lets the reporter resolve digests and tags so artifact names are useful on Kosli.

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    gcloud artifacts repositories add-iam-policy-binding <your-repo> \
        --location=<your-gcp-region> \
        --member="serviceAccount:kosli-reporter@<your-gcp-project>.iam.gserviceaccount.com" \
        --role="roles/artifactregistry.reader" \
        --project=<your-gcp-project>
    ```

    Repeat the command for every Artifact Registry repository that holds images deployed to Cloud Run in this project.

    <Note>
      If you deploy any Cloud Functions 2nd-gen functions in this project, also grant the same role on the Google-managed `gcf-artifacts` repository in the same region. 2nd-gen functions store their backing images there, and the reporter needs read access to resolve them.
    </Note>
  </Step>

  <Step title="Deploy the reporter as a Cloud Run Job">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    gcloud run jobs deploy kosli-reporter \
        --image=ghcr.io/kosli-dev/cli:latest \
        --region=<your-gcp-region> \
        --project=<your-gcp-project> \
        --service-account=kosli-reporter@<your-gcp-project>.iam.gserviceaccount.com \
        --set-env-vars=KOSLI_ORG=<your-kosli-org-name>,KOSLI_HOST=https://app.kosli.com \
        --set-secrets=KOSLI_API_TOKEN=kosli-api-token:latest \
        --args=snapshot,cloud-run,cloud-run-tutorial,--project,<your-gcp-project>,--region,<your-gcp-region>,--resolve-names
    ```

    <Tip>
      Pin the CLI image to a specific version (for example `ghcr.io/kosli-dev/cli:v2.18.0`) so the reporter behavior does not change unexpectedly when a new release is published.
    </Tip>

    <Note>
      Cloud Run Jobs are created with `deletionProtection=true` by default. You will need to disable it (`gcloud run jobs update kosli-reporter --no-deletion-protection --region=<your-gcp-region>`) before you can delete or replace the Job later.
    </Note>
  </Step>

  <Step title="Schedule the reporter with Cloud Scheduler">
    Create a Cloud Scheduler job that triggers the Cloud Run Job every five minutes, and grant its service account permission to invoke the Job:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    gcloud scheduler jobs create http kosli-reporter-schedule \
        --location=<your-gcp-region> \
        --schedule="*/5 * * * *" \
        --uri="https://run.googleapis.com/v2/projects/<your-gcp-project>/locations/<your-gcp-region>/jobs/kosli-reporter:run" \
        --http-method=POST \
        --oauth-service-account-email=kosli-reporter@<your-gcp-project>.iam.gserviceaccount.com \
        --project=<your-gcp-project>

    gcloud run jobs add-iam-policy-binding kosli-reporter \
        --region=<your-gcp-region> \
        --member="serviceAccount:kosli-reporter@<your-gcp-project>.iam.gserviceaccount.com" \
        --role="roles/run.invoker" \
        --project=<your-gcp-project>
    ```
  </Step>

  <Step title="Verify the reporter">
    In the GCP console, open **Cloud Run** -> **Jobs** -> **kosli-reporter** and check the execution logs for a recent successful run. Then confirm that a fresh snapshot has appeared for the `cloud-run-tutorial` environment in the Kosli UI.
  </Step>
</Steps>

## What you've accomplished

You have reported a snapshot of your Cloud Run environment to Kosli. Kosli now tracks the running services and jobs in that environment and will record changes as they happen.

From here you can:

* Query your environment with [`kosli list snapshots`](/client_reference/kosli_list_snapshots) and [`kosli get snapshot`](/client_reference/kosli_get_snapshot)
* [Compare snapshots to see what changed](/client_reference/kosli_diff_snapshots)
* Trace a running artifact back to its git commit with the [From commit to production](/tutorials/following_a_git_commit_to_runtime_environments) tutorial


# Report Kubernetes environments to Kosli
Source: https://docs.kosli.com/tutorials/report_k8s_envs

Learn how to report running artifacts from a Kubernetes cluster to Kosli — using a Helm chart for production, the CLI for a quick test, or an externally scheduled cron job.

By the end of this tutorial, you will have reported a snapshot of your Kubernetes cluster to Kosli, making its running artifacts visible and trackable.

## Prerequisites

* Have access to a Kubernetes cluster.
* [Create a Kubernetes Kosli environment](/getting_started/environments#create-an-environment) named `k8s-tutorial`.
* [Get a Kosli API token](/getting_started/authenticating_to_kosli).

## Report a snapshot

<Tabs>
  <Tab title="Helm chart (recommended)">
    The [Kosli K8S reporter Helm chart](/helm) deploys a <Tooltip>CronJob</Tooltip> inside your cluster that automatically reports running artifacts to Kosli on a schedule. This is the recommended approach for production use.

    [Install Helm](https://helm.sh/docs/intro/install/) if you have not done so.

    1. Create a Kubernetes secret containing your Kosli API token:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kubectl create secret generic kosli-api-token --from-literal=apikey=<your-kosli-api-token>
    ```

    <Warning>
      Make sure the secret value does not contain trailing whitespace.
    </Warning>

    2. Create a `tutorial-values.yaml` file to configure the chart:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    # the cron schedule at which the reporter is triggered
    cronSchedule: "*/5 * * * *"

    kosliApiToken:
      # the name of the secret containing the Kosli API token
      secretName: "kosli-api-token"
      # the key in the secret data that contains the token
      secretKey: "apikey"

    reporterConfig:
      # the name of the Kosli org
      kosliOrg: "<your-kosli-org-name>"
      # the Kosli environment(s) to report to
      environments:
        # omit the namespace fields to report the entire cluster
        - name: "k8s-tutorial"
          # optionally restrict to specific namespaces:
          # namespaces: [namespace1, namespace2]
    ```

    3. Install the chart:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    helm repo add kosli https://charts.kosli.com/
    helm repo update
    helm install kosli-reporter kosli/k8s-reporter -f tutorial-values.yaml
    ```

    4. Confirm the CronJob was created:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kubectl get cronjobs
    ```

    The CronJob will now run every 5 minutes and report what is running in the cluster to Kosli.

    <Note>
      Running on EKS with Karpenter, or another node autoscaler? A reporter pod arriving every 5 minutes can stop nodes being consolidated. Pin the reporter to a stable node group, widen `cronSchedule`, or run it out of cluster. See [Running on EKS with Karpenter](/helm/k8s_reporter/karpenter).
    </Note>
  </Tab>

  <Tab title="Externally scheduled cron">
    If you cannot run the reporter inside the cluster, you can run `kosli snapshot k8s` from outside on a regular schedule. This requires network access to the cluster from wherever the CLI runs.

    The example below uses a GitHub Actions scheduled workflow:

    <Info>
      The workflow requires the following GitHub Actions secrets: `MY_KOSLI_API_TOKEN`, `GKE_SA_KEY`, `GKE_PROJECT`.
    </Info>

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    name: Regular Kubernetes reports to Kosli

    on:
      workflow_dispatch:
      schedule:
        - cron: '0 * * * *' # every hour

    jobs:
      k8s-report:
        runs-on: ubuntu-latest
        permissions:
          id-token: write
          contents: write
        env:
          KOSLI_API_TOKEN: ${{ secrets.MY_KOSLI_API_TOKEN }}

        steps:
          - name: Install Kosli CLI
            uses: kosli-dev/setup-cli-action@v5

          # Replace this step with one that connects to your cluster if not using GKE
          - name: Connect to GKE
            uses: 'Swibi/connect-to-gke'
            with:
              GCP_SA_KEY: ${{ secrets.GKE_SA_KEY }}
              GCP_PROJECT_ID: ${{ secrets.GKE_PROJECT }}
              GKE_CLUSTER: <your-cluster-name>
              GKE_ZONE: <your-cluster-zone>

          - name: Report K8S snapshot to Kosli
            run: kosli snapshot k8s k8s-tutorial --org <your-kosli-org-name>

          - name: Notify Slack on failure
            if: ${{ failure() }}
            uses: rtCamp/action-slack-notify@v2
            env:
              SLACK_CHANNEL: kosli-reports-failure
              SLACK_COLOR: ${{ job.status }}
              SLACK_TITLE: Reporting K8S artifacts to Kosli has failed
              SLACK_USERNAME: GithubActions
              SLACK_WEBHOOK: ${{ secrets.SLACK_CI_FAILURES_WEBHOOK }}
              SLACK_MESSAGE: "Reporting K8S artifacts to Kosli has failed. Please check the logs for more details."
    ```
  </Tab>

  <Tab title="Kosli CLI (testing only)">
    <Warning>
      This approach is intended for ad-hoc and local testing only. Do not use it in production — use the Helm chart instead.
    </Warning>

    [Install Kosli CLI](/getting_started/install) if you have not done so.

    <Info>
      All commands below use the default <Tooltip>kubeconfig context</Tooltip>. Pass `--kubeconfig` to use a different one.
    </Info>

    To report all artifacts running in the entire cluster:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot k8s k8s-tutorial \
        --api-token <your-api-token-here> \
        --org <your-kosli-org-name>
    ```

    To report only artifacts running in specific namespaces:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot k8s k8s-tutorial \
        --namespaces namespace1,namespace2 \
        --api-token <your-api-token-here> \
        --org <your-kosli-org-name>
    ```

    To report the entire cluster except for certain namespaces:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot k8s k8s-tutorial \
        --exclude-namespaces namespace1,namespace2 \
        --api-token <your-api-token-here> \
        --org <your-kosli-org-name>
    ```
  </Tab>
</Tabs>

## Running multiple reporters

If you are considering running more than one reporter against the same cluster, the table below summarizes which setups produce meaningful snapshots and which don't.

| Scenario                                                                 | Supported | Explanation                                                                                                                    |
| :----------------------------------------------------------------------- | :-------: | :----------------------------------------------------------------------------------------------------------------------------- |
| Two orgs, separate environments, overlapping namespaces                  |    Yes    | Different environments → independent snapshots.                                                                                |
| One org, two environments, overlapping namespaces                        |    Yes    | Same as above.                                                                                                                 |
| One org, **same environment**, two reporters with overlapping namespaces |     No    | Snapshots toggle between each reporter's view. No data is deleted, but diffs between consecutive snapshots become meaningless. |
| One org, same environment, two reporters with **disjoint** namespaces    |     No    | Each snapshot only reflects one reporter's namespaces, so diffs compare unrelated scopes.                                      |

<Warning>
  A single Kosli environment must have exactly one reporter feeding it. Snapshots are never overwritten or deleted, but if two reporters take turns updating the same environment:

  * Diffs between consecutive snapshots compare unrelated views of the cluster.
  * The environment history shows artifacts continuously stopping and starting as each report toggles which namespaces are visible.
</Warning>

## What you've accomplished

You have reported a snapshot of your Kubernetes cluster to Kosli. Kosli now tracks the running artifacts in that environment and will record changes as they happen.

From here you can:

* Query your environment with [`kosli list snapshots`](/client_reference/kosli_list_snapshots) and [`kosli get snapshot`](/client_reference/kosli_get_snapshot)
* [Compare snapshots to see what changed](/client_reference/kosli_diff_snapshots)
* Trace a running artifact back to its git commit with the [From commit to production](/tutorials/following_a_git_commit_to_runtime_environments) tutorial


# Working with repositories
Source: https://docs.kosli.com/tutorials/repositories

Learn how VCS code repositories are captured in Kosli and how to view builds, deployments, and live artifacts from the Kosli app.

Repositories in Kosli refer to your version control (VCS) code repositories — such as those hosted on GitHub, GitLab, Bitbucket, or Azure DevOps. By connecting your code repositories to Kosli, you get a repo-centric view of your software supply chain. Instead of navigating across flows, trails, and environments separately, you can start from a repository and see everything that matters: what was built, where it was deployed, and what is running right now.

This is useful when you need to:

* **Answer audit questions quickly** — "What version of this repo is running in production?" or "How often do we deploy this service?"
* **Track DORA-style metrics per repo** — build frequency, deployment frequency, and lead time for changes, broken down by environment.
* **Verify compliance at a glance** — see which commits are currently running across all environments and whether their artifacts are compliant.
* **Investigate incidents** — trace a running artifact back to its source commit, build, and full attestation history.

## Prerequisites

* [Install Kosli CLI](/getting_started/install) (v2.11.35 or higher).
* [Get a Kosli API token](/getting_started/authenticating_to_kosli).
* Have a [Flow](/getting_started/flows) and [Trail](/getting_started/trails) already created.

## Setup

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=<your-org>
export KOSLI_API_TOKEN=<your-api-token>
```

## Creating a repository

You do not create repos manually. Kosli captures repository information from attestations that include repo metadata. In CI environments, the CLI automatically populates these fields from environment variables (e.g. `GITHUB_REPOSITORY` in GitHub Actions).

You can also provide repo metadata explicitly using these flags on `kosli attest` and `kosli begin trail` commands:

| Flag              | Description                                                                                                |
| ----------------- | ---------------------------------------------------------------------------------------------------------- |
| `--repository`    | Name of the git repo as registered in Kosli (e.g. `my-org/my-repo`).                                       |
| `--repo-provider` | VCS provider: `github`, `gitlab`, `bitbucket`, or `azure-devops`. Must be one of these values if provided. |
| `--repo-url`      | URL of the repository. Must be a valid URL with a scheme and host (see URL format details below).          |
| `--repo-id`       | Unique identifier of the repository in the VCS provider (see choosing a repo ID below).                    |

All four flags are needed to fully populate repository information in Kosli. In [supported CI systems](/integrations/ci_cd), some of these flags are auto-defaulted from environment variables. In unsupported CI systems (e.g. Jenkins), you must provide all flags explicitly.

### `--repo-url` format

The `--repo-url` flag must be a valid URL with a scheme (`https://`) and a host. The CLI validates this when the flag is provided.

* **HTTPS web URLs** (recommended): `https://github.com/my-org/my-repo` or `https://bitbucket.org/my-workspace/my-repo`
* **HTTPS clone URLs**: `https://bitbucket.org/my-workspace/my-repo.git` — these pass validation and work, but we recommend dropping the `.git` suffix for consistency with how Kosli displays the URL in the app and CLI output.
* **SSH clone URLs**: `git@github.com:my-org/my-repo.git` — these **do not work** because they lack a URL scheme and fail CLI validation.

<Tip>
  Use the plain web URL without `.git` (e.g. `https://bitbucket.org/my-workspace/my-repo`). This is the canonical format used across Kosli and matches what appears in the UI and CLI output.
</Tip>

### Choosing a `--repo-id`

The `--repo-id` should be a **stable, unique identifier** for the repository in your VCS provider. Avoid using the repository name, as it can change if the repo is renamed or moved to another provider.

Good choices for `--repo-id`:

* **GitHub**: The numeric repository ID (available via the GitHub API).
* **GitLab**: The `CI_PROJECT_ID` environment variable.
* **Bitbucket**: The `BITBUCKET_REPO_UUID` environment variable (available in Bitbucket Pipelines). If running in Jenkins with a Bitbucket repo, retrieve this value from the Bitbucket API or check a UUID into the repo in a file.
* **Azure DevOps**: The `Build.Repository.ID` predefined variable.

### Using repo flags in unsupported CI systems

If your CI system is not in the [list of supported CI systems](/integrations/ci_cd) (e.g. Jenkins, Bamboo), the CLI cannot auto-default repo metadata from environment variables. You must provide all four flags explicitly — `--repository`, `--repo-provider`, `--repo-url`, and `--repo-id`.

For example, in a Jenkinsfile for a Bitbucket repository:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest artifact my-app:latest \
    --name my-app \
    --flow my-flow \
    --trail my-trail \
    --artifact-type oci \
    --repository my-workspace/my-repo \
    --repo-provider bitbucket \
    --repo-url https://bitbucket.org/my-workspace/my-repo \
    --repo-id "${BITBUCKET_REPO_UUID}" \
    --commit $(git rev-parse HEAD)
```

### Attest an artifact with repo metadata

If you are running outside of CI or in an unsupported CI system, provide the repo flags explicitly:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest artifact my-app:latest \
    --name my-app \
    --flow my-flow \
    --trail my-trail \
    --artifact-type oci \
    --repository my-org/my-repo \
    --repo-provider github \
    --repo-url https://github.com/my-org/my-repo \
    --repo-id 123456789 \
    --commit $(git rev-parse HEAD)
```

### Verify your repository in Kosli

After attesting, verify that Kosli captured your repository using the CLI:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list repos
```

You should also be able to see the repository in the [Kosli app](https://app.kosli.com) by navigating to **Repositories** in the sidebar. Your newly captured repository appears in the list, and you can search by name to find it.

<Frame>
  <img alt="Kosli app showing the repositories list with repos from multiple VCS providers" />
</Frame>

## Tracking builds

A build is recorded in Kosli the first time you attest an artifact. Subsequent attestations for that artifact fingerprint do not create additional build records.

Tracking builds per repository helps you understand your team's development cadence. You can see how frequently new artifacts are produced and spot changes in build activity over time — for example, a sudden drop may indicate a blocked pipeline, while a spike could signal a release push.

### View build metrics in the Kosli app

In the [Kosli app](https://app.kosli.com), navigate to your repository and open the **Build** tab. This view shows:

* **Build frequency chart** — a visualization of how often builds occur over a configurable time period (last 7, 14, 28, or 90 days).
* **Builds list** — a paginated list of individual builds within the selected period, including commit details and timestamps.

Use the time period selector to adjust the range and analyze build trends.

<Frame>
  <img alt="Kosli app showing the Build tab with build frequency chart and builds list" />
</Frame>

## Tracking deployments

Kosli detects deployments automatically when an artifact appears in an [environment snapshot](/getting_started/environments). If the artifact was attested with repository metadata, the deployment is linked back to the source repository. For details on reporting snapshots, see [reporting Kubernetes environments](/tutorials/report_k8s_envs) or [reporting AWS environments](/tutorials/report_aws_envs).

Tracking deployments per repository gives you visibility into how changes flow from build to production. You can measure deployment frequency and lead time for changes — two of the four DORA metrics — broken down by environment.

### View deployment metrics in the Kosli app

In the [Kosli app](https://app.kosli.com), navigate to your repository and open the **Release** tab. This tab has two sub-views:

**Metrics** — shows per-environment charts for:

* **Deployment frequency** — how often deployments happen over a configurable time period.
* **Lead time for changes** — how long it takes from build to deployment.

<Frame>
  <img alt="Kosli app showing the Release Metrics view with deployment lead time and deployment frequency charts" />
</Frame>

**Deployments** — shows a paginated list of individual deployments with:

* Which environment received the artifact.
* The commit and artifact details.
* Time period and environment filtering to compare deployment patterns across staging, production, etc.

<Frame>
  <img alt="Kosli app showing the Release Deployments view with a list of deployments per environment" />
</Frame>

## Viewing live artifacts

The live artifacts view gives you an at-a-glance picture of what is currently running from a repository across all your environments. This allows you to see the compliance of the artifacts and the commit that each artifact was built from.

This is particularly useful for:

* **Incident response** — quickly identify which version of a service is running in production.
* **Drift detection** — spot when different environments are running different commits from the same repo.
* **Compliance audits** — verify that all running artifacts are compliant without checking each environment individually.

### View live status in the Kosli app

In the [Kosli app](https://app.kosli.com), navigate to your repository and open the **Run** tab. This view shows a table with:

* **Commit** — the source commit for each group of running artifacts, including the commit SHA, author, message, and timestamp.
* **Environment** — the environments where artifacts from that commit are running, with links to the relevant environment snapshot.
* **Artifact** — the individual artifacts running in each environment, with their compliance status (compliant or non-compliant) and fingerprint.

Use the environment filter to narrow the view to specific environments.

<Frame>
  <img alt="Kosli app showing the Run tab with live artifacts, their commits, environments, and compliance status" />
</Frame>

## What you've accomplished

You have learned how Kosli automatically captures repositories from attestations and how to use the Kosli app to monitor builds, deployments, and live artifacts for a repository.

From here you can:

* Learn more about [environments](/getting_started/environments)
* Learn more about [attestations](/getting_started/attestations)
* [Query Kosli](/tutorials/querying_kosli) for detailed artifact provenance


# Rotating API keys
Source: https://docs.kosli.com/tutorials/rotating_api_keys

Learn how to rotate Kosli service account API keys with zero downtime.

Rotating API keys regularly is a security best practice that limits the blast radius of a leaked or compromised credential. This tutorial walks you through rotating a Kosli service account API key with zero downtime, using the Kosli web app, the CLI, or the API directly.

<Tip>
  Kosli never stores your API token in plain text. Only a cryptographic hash of the token is stored, so the original token cannot be retrieved from our systems — make sure to copy a new key immediately after creating or rotating it.
</Tip>

## Prerequisites

* A Kosli shared organization with at least one [service account](/administration/authentication/service_accounts) and an existing API key.
* Administrator access to the organization that owns the service account.
* An inventory of every system (CI pipelines, runtime reporters, scripts, secrets managers, etc.) that uses the API key you plan to rotate.

## How rotation works

When you rotate a service account API key, Kosli:

1. Generates a **new** API key immediately and returns its value **once**.
2. Keeps the **old** key valid for a configurable grace period (default: **24 hours**).
3. Automatically revokes the old key when the grace period expires.

The grace period lets you roll the new key out to all consumers without an interruption in service. Choose a window that matches your deployment cadence — short enough to limit exposure, long enough to update every dependent system.

## Rotate a key

Choose the interface that best fits your workflow. All three trigger the same rotation flow described above.

<Tabs>
  <Tab title="Web UI">
    1. Log in to Kosli and select the organization that owns the service account.
    2. Go to **Settings** → **Service accounts** in the left navigation.
    3. Open the service account whose key you want to rotate.
    4. Find the key in the **API Keys** list and click **Regenerate**.
    5. Choose a grace period for the old key, then confirm.
    6. Copy the new key value immediately and store it in your secrets manager — it will not be shown again.
  </Tab>

  <Tab title="CLI">
    Use the [`kosli rotate api-key`](/client_reference/kosli_rotate_api-key) command to rotate one or more keys from your terminal or a CI job:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli rotate api-key <<key-id>> \
      --service-account <<service-account-name>> \
      --grace-period-hours 24 \
      --api-token "$KOSLI_ADMIN_TOKEN" \
      --org "$ORG"
    ```

    Rotate multiple keys for the same service account in one call by passing additional key IDs. When `--grace-period-hours` is omitted, the server-side default grace period applies:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli rotate api-key keyID1 keyID2 \
      --service-account <<service-account-name>> \
      --api-token "$KOSLI_ADMIN_TOKEN" \
      --org "$ORG"
    ```

    Use `--output json` to capture the new key value programmatically:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    NEW_KEY=$(kosli rotate api-key <<key-id>> \
      --service-account <<service-account-name>> \
      --api-token "$KOSLI_ADMIN_TOKEN" \
      --org "$ORG" \
      --output json \
      | jq -r '.api_key')
    ```
  </Tab>

  <Tab title="API">
    Call the rotate endpoint directly — useful when integrating with a secrets manager or another automation system:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    curl -X POST \
      -H "Authorization: Bearer <<your-admin-api-key>>" \
      -H "Content-Type: application/json" \
      -d '{"grace_period_hours": 24}' \
      https://app.kosli.com/api/v2/service-accounts/<<your-org>>/<<service-account-name>>/api-keys/<<key-id>>/rotate
    ```

    The response contains the new API key value. Capture it directly into your secrets store:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    NEW_KEY=$(curl -s -X POST \
      -H "Authorization: Bearer $KOSLI_ADMIN_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{"grace_period_hours": 24}' \
      https://app.kosli.com/api/v2/service-accounts/$ORG/$SA_NAME/api-keys/$KEY_ID/rotate \
      | jq -r '.api_key')
    ```
  </Tab>
</Tabs>

<Tip>
  You can list a service account's keys (including the rotation status of the old key) with `GET /service-accounts/{org}/{name}/api-keys`. See the [API reference](/api-reference/service-accounts/list-api-keys-for-a-service-account) for details.
</Tip>

## Roll the new key out

While the old key is still valid, update every consumer to use the new key:

* **CI/CD pipelines**: Update the `KOSLI_API_TOKEN` secret in GitHub Actions, GitLab CI, Jenkins, CircleCI, etc.
* **Runtime reporters**: Update Kubernetes secrets used by the [Kosli Kubernetes reporter](/helm/k8s_reporter), and roll the relevant pods.
* **Local config files**: Update any [Kosli CLI config files](/getting_started/install#assigning-flags-via-config-files) that hard-code the token.
* **Secrets managers**: Update the value in AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager, Azure Key Vault, or wherever you store the token.

Verify the rollout by triggering a job (or running a Kosli CLI command) that uses the new key and confirming it succeeds:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list environments --api-token "$NEW_KEY" --org "$ORG"
```

## Verify the old key is decommissioned

Once every consumer is on the new key, you can either wait for the grace period to elapse or revoke the old key immediately:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
curl -X DELETE \
  -H "Authorization: Bearer <<your-admin-api-key>>" \
  https://app.kosli.com/api/v2/service-accounts/<<your-org>>/<<service-account-name>>/api-keys/<<old-key-id>>
```

See [Revoke an API key for a service account](/api-reference/service-accounts/revoke-an-api-key-for-a-service-account) for details.

After revocation (or grace-period expiry), confirm the old key no longer works:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
curl -i -H "Authorization: Bearer $OLD_KEY" \
  https://app.kosli.com/api/v2/environments/$ORG
# Expect: HTTP/1.1 401 Unauthorized
```

## Recommended rotation cadence

* **Service accounts**: rotate at least every 90 days, and immediately if you suspect a leak.
* **After offboarding**: rotate any key an offboarded user could have accessed.
* **After incidents**: rotate any key potentially exposed by a security incident, regardless of cadence.

Automating rotation from your secrets manager — using the rotate endpoint above — is the most reliable way to keep within your target cadence.

## Related

* [Service accounts](/administration/authentication/service_accounts)
* [Rotate an API key for a service account (API reference)](/api-reference/service-accounts/rotate-an-api-key-for-a-service-account)
* [Revoke an API key for a service account (API reference)](/api-reference/service-accounts/revoke-an-api-key-for-a-service-account)
* [List API keys for a service account (API reference)](/api-reference/service-accounts/list-api-keys-for-a-service-account)


# Tracing a production incident to its git commit
Source: https://docs.kosli.com/tutorials/tracing_a_production_incident_back_to_git_commits

Learn how to use Kosli to trace a production 500 error in cyber-dojo back to the specific git commit that caused it — without any access to the production environment.

By the end of this tutorial, you will have traced a production incident from a 500 error all the way back to the git commit that caused it, using only Kosli CLI queries against the public cyber-dojo organization.

<Frame>
  <img alt="Prod cyber-dojo is down with a 500" />
</Frame>

[https://cyber-dojo.org](https://cyber-dojo.org) is showing a 500 error. It was working an hour ago. What changed?

## Prerequisites

* [Install Kosli CLI](/getting_started/install).
* [Get a Kosli API token](/getting_started/authenticating_to_kosli).

## Setup

The `cyber-dojo` Kosli organization is public, so any authenticated user can read its data:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=cyber-dojo
export KOSLI_API_TOKEN=<your-api-token>
```

## Start with the environment

[https://cyber-dojo.org](https://cyber-dojo.org) runs in an AWS environment that reports to Kosli as `aws-prod`. Get a log of its recent changes:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli log env aws-prod
```

The environment has accumulated many snapshots since this incident occurred. To focus on the relevant ones, scope the log to snapshots 176 and 177:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli log env aws-prod --interval 176..177
```

You should see:

```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
SNAPSHOT  EVENT                                                                          FLOW
#177      Artifact: 274425519734.dkr.ecr.eu-central-1.amazonaws.com/creator:31dee35      creator-archived-at-1707630496
          Fingerprint: 5d1c926530213dadd5c9fcbf59c8822da56e32a04b0f9c774d7cdde3cf6ba66d
          Description: 1 instance stopped running (from 1 to 0)
          Reported at: Tue, 06 Sep 2022 16:53:28 CEST

#176      Artifact: 274425519734.dkr.ecr.eu-central-1.amazonaws.com/creator:b7a5908      creator-archived-at-1707630496
          Fingerprint: 860ad172ace5aee03e6a1e3492a88b3315ecac2a899d4f159f43ca7314290d5a
          Description: 1 instance started running (from 0 to 1)
          Reported at: Tue, 06 Sep 2022 16:52:28 CEST
```

<Info>
  When this incident happened the flow was simply named `creator`. The flow has since been archived, and archiving a flow currently renames it by appending `-archived-at-<timestamp>`. The historical evidence is unchanged; only the displayed name is longer.
</Info>

These two snapshots are part of the same <Tooltip>blue-green deployment</Tooltip>: `creator:b7a5908` started in snapshot #176, and `creator:31dee35` stopped in snapshot #177. The new artifact arrived just before the 500 error — that is the one to investigate.

## Dig into the artifact

Get the full history of `creator:b7a5908` with `kosli search`, using the fingerprint prefix from snapshot #176:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli search 860ad17
```

You should see:

```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
Search result resolved to artifact with fingerprint 860ad172ace5aee03e6a1e3492a88b3315ecac2a899d4f159f43ca7314290d5a
Name:              cyberdojo/creator:b7a5908
Fingerprint:       860ad172ace5aee03e6a1e3492a88b3315ecac2a899d4f159f43ca7314290d5a
Has provenance:    true
Flow:              creator-archived-at-1707630496
Git commit:        b7a590836cf140e17da3f01eadd5eca17d9efc65
Commit URL:        https://github.com/cyber-dojo/creator/commit/b7a590836cf140e17da3f01eadd5eca17d9efc65
Build URL:         https://github.com/cyber-dojo/creator/actions/runs/3001102984
Artifact URL:      https://app.kosli.com/cyber-dojo/flows/creator-archived-at-1707630496/artifacts/860ad172ace5aee03e6a1e3492a88b3315ecac2a899d4f159f43ca7314290d5a
Compliance state:  COMPLIANT
Running in:        [  ]
Exited from:       [ aws-beta, aws-prod ]
History:
    Artifact created                               Tue, 06 Sep 2022 16:48:07 CEST
    Started running in aws-beta#196 environment    Tue, 06 Sep 2022 16:51:42 CEST
    Started running in aws-prod#176 environment    Tue, 06 Sep 2022 16:52:28 CEST
    No longer running in aws-beta#199 environment  Tue, 06 Sep 2022 21:28:42 CEST
    No longer running in aws-prod#179 environment  Tue, 06 Sep 2022 21:30:28 CEST
```

The artifact started running in `aws-prod` at 16:52 — right when the incident began. The output includes a direct link to the git commit. (You can also see the artifact exiting both environments later that evening, once the incident was fixed by a newer commit.)

## Follow to the commit

Open the [commit URL](https://github.com/cyber-dojo/creator/commit/b7a590836cf140e17da3f01eadd5eca17d9efc65) from the output:

<Frame>
  <img alt="cyber-dojo github diff" />
</Frame>

A simple typo in `app.rb` — an extra `s` inserted into the method name. The function is called `respond_to`, not `responds_to`. That one character caused the 500 error.

## What you've accomplished

You traced a production 500 error back to a specific git commit — without any direct access to `aws-prod`. By querying the environment log and artifact history in Kosli, you identified exactly which deployment introduced the incident and which code change caused it.

From here you can:

* Learn more about environment and artifact queries in the [Querying Kosli](/tutorials/querying_kosli) tutorial
* Learn how to follow any commit from CI into production with the [From commit to production](/tutorials/following_a_git_commit_to_runtime_environments) tutorial


# Adding trail summaries to CI pipeline runs
Source: https://docs.kosli.com/tutorials/trail_summaries_in_ci

Use kosli get trail --output markdown to publish a Kosli trail summary directly to GitHub Actions and GitLab CI pipeline runs.

`kosli get trail --output markdown` renders a trail as GitHub-Flavored Markdown — compliance state, git commit, attestation statuses, and events, with links back to the Kosli app. Pipe it into your CI's job summary and every pipeline run becomes an information radiator for the trail it produced.

By the end of this tutorial, you will have added a Kosli trail summary to a GitHub Actions job summary and to a GitLab CI pipeline.

## Prerequisites

* [Install Kosli CLI](/getting_started/install) on your CI runner (e.g. via [`kosli-dev/setup-cli-action`](https://github.com/marketplace/actions/setup-kosli-cli) on GitHub).
* A flow and trail you are already reporting to during the pipeline. See [Querying Kosli](/tutorials/querying_kosli) if you need to find the flow and trail name.
* `KOSLI_API_TOKEN` and `KOSLI_ORG` available to the job (see [Authenticating to Kosli](/getting_started/authenticating_to_kosli)).

## What the markdown output looks like

Run the command locally first to see what will end up in your CI summary:

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli get trail my-trail-name --flow my-flow --output markdown
```

The output is a markdown document with:

* A `## Trail: <name>` heading linked to the trail page in the Kosli app.
* A metadata table (name, description, compliance, last modified, origin).
* A `### Git commit` table with the commit author, timestamp, and subject.
* An `### Attestations` section with one headerless table per artifact (and one for trail-level attestations), with each attestation linked to its place on the trail page. Statuses are prefixed with ✅ / ❌ / ⏳; attestations reported but not expected by the template are marked with `(+)`.
* An `### Events` table with timestamps, descriptions, commit links, and compliance state.

<Frame>
  <img alt="Trail summary showing compliance status, git commit metadata, per-artifact attestation tables, and event history" />
</Frame>

## Publishing the summary

<Tabs>
  <Tab title="GitHub" icon="github">
    GitHub Actions exposes a per-job markdown summary via the [`$GITHUB_STEP_SUMMARY`](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#adding-a-job-summary) environment variable. Anything you append to that file is rendered on the workflow run page.

    Add a final step to your job that writes the trail summary to it:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    jobs:
      build:
        runs-on: ubuntu-latest
        env:
          KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }}
          KOSLI_ORG: my-org
          KOSLI_FLOW: my-flow
          KOSLI_TRAIL: ${{ github.sha }}
        steps:
          - uses: actions/checkout@v7

          - name: Setup Kosli CLI
            uses: kosli-dev/setup-cli-action@v5

          # ... your build, attest, and report steps ...

          - name: Publish Kosli trail summary
            if: always()
            run: |
              kosli get trail "$KOSLI_TRAIL" \
                --flow "$KOSLI_FLOW" \
                --output markdown >> "$GITHUB_STEP_SUMMARY"
    ```

    `if: always()` makes sure the summary is published even when an earlier step fails — that is when you most want to see which attestation is missing or non-compliant.

    The summary appears on the run's page under the job, with the trail name linking back to the trail in the Kosli app and every attestation linking to its position on the trail.
  </Tab>

  <Tab title="GitLab" icon="gitlab">
    GitLab does not natively render markdown inline on the job page, but [`artifacts:expose_as`](https://docs.gitlab.com/ci/yaml/artifacts/#expose_as) surfaces the `summary.md` artifact as a labeled link in the merge request widget, one click away from the rendered file in the GitLab UI.

    Add a job (or a final step in your existing job) that produces that artifact. Use the [Kosli Alpine CI runner image](/integrations/ci_cd#ci-runner-image-alpine) so `kosli`, `git`, and `curl` are preinstalled and no `before_script` setup is needed:

    ```yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli-trail-summary:
      stage: .post
      image: registry.example.com/ci/kosli-runner:2.28.0  # replace with the tag you pushed
      variables:
        KOSLI_FLOW: my-flow
        KOSLI_TRAIL: $CI_COMMIT_SHA
      script:
        - >
          kosli get trail "$KOSLI_TRAIL"
          --flow "$KOSLI_FLOW"
          --output markdown > summary.md
      artifacts:
        when: always
        paths:
          - summary.md
        expose_as: "Kosli trail summary"
    ```

    Replace `registry.example.com/ci/kosli-runner:2.28.0` with whatever tag you pushed when you built the Alpine image — see [CI runner image (Alpine)](/integrations/ci_cd#ci-runner-image-alpine) for the build steps.

    `KOSLI_API_TOKEN` and `KOSLI_ORG` should be set as [CI/CD variables](https://docs.gitlab.com/ci/variables/) on the project or group, masked, so the job picks them up automatically.

    `when: always` mirrors the GitHub `if: always()` pattern: the summary is uploaded even if earlier stages fail.
  </Tab>
</Tabs>

## Tips

* Pin a specific trail by exporting `KOSLI_TRAIL` early in the pipeline (commonly to the commit SHA you used in `kosli begin trail`). Every later step — including the summary — then targets the same trail.
* The markdown output is stable text. You can also commit it as a build artifact or attach it to a release for an audit-friendly record of what was reported for that build.
* Run `kosli get trail --output markdown` locally against a real trail before wiring it into CI. It is the fastest way to see what your team will see on the pipeline page.

## What you've accomplished

You have published a live Kosli trail summary — compliance state, attestations, and events — directly onto your GitHub Actions and GitLab CI pipeline pages, turning every build into a feedback channel for the trail it produced.

From here you can:

* Read the full [`kosli get trail`](/client_reference/kosli_get_trail) reference.
* Browse other [CI/CD integration patterns](/integrations/ci_cd).


# Try Kosli locally
Source: https://docs.kosli.com/tutorials/try_kosli_locally

A quick local demo of Kosli's core features using Docker — no GitHub account or CI pipeline required. Runs entirely from your terminal in about 10 minutes.

<Info>
  This tutorial runs entirely on your local machine using Docker — no GitHub account or CI pipeline required. If you'd prefer a full hands-on introduction using a real CI/CD pipeline, see the [Kosli Learning Labs](/labs) instead.
</Info>

In this tutorial, you'll learn how Kosli allows you to track a source code change from runtime environments.
You'll set up a `docker` environment, use Kosli to record build and deployment events, and track what
artifacts are running in your runtime environment.

<Tip>
  As you go through the steps you can also check your progress in [your browser](https://app.kosli.com). In the upper left corner, select the organization you want to view — your personal organization has the same name as your GitHub login.
</Tip>

## Prerequisites

* Install Docker.
* [Install Kosli CLI](/getting_started/install).
* [Get a Kosli API token](/getting_started/authenticating_to_kosli).

## Steps

<Steps>
  <Step title="Set up">
    Set the `KOSLI_ORG` and `KOSLI_API_TOKEN` environment variables:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    export KOSLI_ORG=<your-org>
    export KOSLI_API_TOKEN=<your-api-token>
    ```

    Check your Kosli setup:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list flows
    ```

    This should return a list of flows or "No flows were found".

    Clone the quickstart repository and export the current commit SHA:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    git clone https://github.com/kosli-dev/quickstart-docker-example.git
    cd quickstart-docker-example
    export GIT_COMMIT=$(git rev-parse HEAD)
    ```
  </Step>

  <Step title="Create a Kosli Flow">
    The repository includes a `kosli.yml` template file. Inspect it:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    cat kosli.yml
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    trail:
      artifacts:
        - name: nginx
    ```

    Create a Flow called `quickstart-nginx` using this template:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create flow quickstart-nginx \
        --description "Flow for quickstart nginx image" \
        --template-file kosli.yml
    ```

    Confirm it was created:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list flows
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    NAME              DESCRIPTION                          VISIBILITY
    quickstart-nginx  Flow for quickstart nginx image      private
    ```

    <Info>
      In the web interface, select **Flows** in the left sidebar. You should see `quickstart-nginx` listed. No artifacts have been reported yet.
    </Info>
  </Step>

  <Step title="Create a Kosli Trail">
    Create a Trail in the `quickstart-nginx` Flow, named after the current git commit:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli begin trail ${GIT_COMMIT} \
        --flow quickstart-nginx
    ```
  </Step>

  <Step title="Attest an artifact">
    The repository's `docker-compose.yml` uses a public [nginx](https://nginx.org/) image as the artifact for this tutorial.

    Attest it to Kosli:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli attest artifact nginx:1.21 \
        --name nginx \
        --flow quickstart-nginx \
        --trail ${GIT_COMMIT} \
        --artifact-type oci \
        --build-url https://example.com \
        --commit-url https://github.com/kosli-dev/quickstart-docker-example/commit/9f14efa0c91807da9a8b1d1d6332c5b3aa24a310 \
        --commit $(git rev-parse HEAD)
    ```

    Verify the artifact was recorded:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list artifacts --flow quickstart-nginx
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    COMMIT   ARTIFACT                                                                       STATE      CREATED_AT
    9f14efa  Name: nginx:1.21                                                               COMPLIANT  Tue, 01 Nov 2022 15:46:59 CET
             Fingerprint: 2bcabc23b45489fb0885d69a06ba1d648aeda973fae7bb981bafbb884165e514
    ```
  </Step>

  <Step title="Create a Kosli environment">
    Create an environment called `quickstart` of type `docker`:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli create environment quickstart \
        --type docker \
        --description "quickstart environment for tutorial"
    ```

    Verify it was created:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list environments
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    NAME        TYPE    LAST REPORT  LAST MODIFIED
    quickstart  docker               2022-11-01T15:30:56+01:00
    ```

    <Info>
      In the web interface, select **Environments**. You should see `quickstart` listed with no snapshots yet.
    </Info>
  </Step>

  <Step title="Report what is running">
    Run the artifact:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    docker compose up -d
    ```

    Confirm the container is running:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    docker ps
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    CONTAINER ID  IMAGE      COMMAND                  CREATED         STATUS         PORTS                  NAMES
    6330e545b532  nginx:1.21 "/docker-entrypoint.…"  35 seconds ago  Up 34 seconds  0.0.0.0:8080->80/tcp   quickstart-nginx
    ```

    Snapshot the environment to report all running containers to Kosli:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli snapshot docker quickstart
    ```

    Confirm the snapshot was created:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli list snapshots quickstart
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    SNAPSHOT  FROM                           TO   DURATION
    1         Tue, 01 Nov 2022 15:55:49 CET  now  11 seconds
    ```

    Get a detailed view of the snapshot:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli get snapshot quickstart
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    COMMIT  ARTIFACT                                                                       FLOW  RUNNING_SINCE  REPLICAS
    N/A     Name: nginx:1.21                                                               N/A   3 minutes ago  1
            Fingerprint: 8f05d73835934b8220e1abd2f157ea4e2260b9c26f6f63a8e3975e7affa46724
    ```

    <Info>
      In the web interface, the **Environments** page will now show a timestamp in the **Last Change At** column. Select `quickstart` to see the full snapshot.
    </Info>
  </Step>

  <Step title="Search Kosli">
    Use `kosli search` to find everything Kosli knows about an artifact or git commit:

    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli search ${GIT_COMMIT}
    ```

    ```plaintext theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    Search result resolved to commit 9f14efa0c91807da9a8b1d1d6332c5b3aa24a310
    Name:              nginx:1.21
    Fingerprint:       2bcabc23b45489fb0885d69a06ba1d648aeda973fae7bb981bafbb884165e514
    Has provenance:    true
    Flow:              quickstart-nginx
    Git commit:        9f14efa0c91807da9a8b1d1d6332c5b3aa24a310
    Commit URL:        https://github.com/kosli-dev/quickstart-docker-example/commit/9f14efa0c91807da9a8b1d1d6332c5b3aa24a310
    Build URL:         https://example.com
    Compliance state:  COMPLIANT
    History:
        Artifact created                             Tue, 01 Nov 2022 15:46:59 CET
        Deployment #1 to quickstart environment      Tue, 01 Nov 2022 15:48:47 CET
        Started running in quickstart#1 environment  Tue, 01 Nov 2022 15:55:49 CET
    ```

    Visit the [Kosli Querying](/tutorials/querying_kosli) guide to learn more about the search command.
  </Step>
</Steps>


# Working with controls
Source: https://docs.kosli.com/tutorials/working_with_controls

Learn how to define controls in Kosli, record decisions against them, and track compliance across your software delivery process.

<Info>
  **This feature is in beta.** Controls, decisions, the controls CLI commands (`kosli create control`, `kosli attest decision`, and related), and the `for_control` policy requirement are all available in Kosli but in beta — the UI, CLI flags, and policy YAML schema may still change. It is rolled out per organization, so reach out to the Kosli team to enable it for yours, or with any questions and comments.
</Info>

Controls in Kosli represent the named, identifiable governance requirements that your organization enforces across software delivery — things like "source code review", "no hard-coded credentials", or "vulnerability scan passed". They are the things auditors ask about, the things compliance teams track, and the things governance platform engineers build automation around.

Without controls as first-class entities, Kosli can tell you *that* an attestation was made, but not *which governance requirement it satisfies*. Controls close that gap: they connect the evidence you collect in pipelines to the specific requirements that auditors, control owners, and regulators care about.

This tutorial covers how to:

* Define a control library in Kosli that mirrors your existing controls catalog
* Record decision outcomes against controls from your pipelines
* Require decisions in flow templates and reference controls in environment policies
* Review the decisions, coverage, and version history of each control

## Prerequisites

* [Install Kosli CLI](/getting_started/install).
* [Get a Kosli API token](/getting_started/service-accounts).
* Have at least one [Flow](/getting_started/flows) and [Trail](/getting_started/trails) already created.

## Setup

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
export KOSLI_ORG=<your-org>
export KOSLI_API_TOKEN=<your-api-token>
```

## Understanding controls

Before creating controls, it helps to understand how they fit into the Kosli data model.

**Raw fact attestations** are the evidence you collect in pipelines — test results, vulnerability scans, pull request approvals. These are facts about what happened.

**Decisions** are the recorded outcomes of a Policy Decision Point (PDP) — the step in your process where a judgment is reached about a specific control: "control `RCTL-043` is satisfied for this artifact." A decision is an attestation that references a control, recorded at the point where the judgment is made — typically during a release or promotion step.

**Controls** are the named governance requirements that decisions are recorded against. They have a stable identity (the control identifier), a human-readable name, and an optional description and links pointing back to your GRC system or policy document.

This separation matters: raw facts exist independently of controls. A JUnit test report is a fact. Whether that test report satisfies a "test coverage" control is a decision. The decision references the fact; the fact doesn't need to know about the control.

A Policy Enforcement Point (PEP) is where that decision is acted upon. `kosli assert artifact --environment` is the PEP — it checks that an artifact satisfies all requirements in the environment's policy, including any listed controls, and exits non-zero if it doesn't. Place it at the point in your pipeline where you want to gate progress on control compliance.

<Info>
  Kosli holds a mirror to your existing control definitions — it does not replace your GRC system or ServiceNow instance. The control catalog in Kosli is a lightweight copy that enables querying and reporting.
</Info>

## Creating a control

Navigate to **Controls** in the [Kosli app](https://app.kosli.com) sidebar and select **New control**. A control has the following fields:

| Field           | Description                                                                                                                                                                                                          |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Identifier**  | **Required.** The control identifier (e.g. `RCTL-043`, `peer-review`, `vuln-scan-production`). Unique within your organization and **immutable once created** — to use a different identifier, create a new control. |
| **Name**        | **Required.** A human-readable label for the control (e.g. `Source code review`). You can rename a control while keeping the same identifier.                                                                        |
| **Description** | Optional. What the control does, in human-readable terms.                                                                                                                                                            |
| **Links**       | Optional. One or more named URLs pointing back to the authoritative definition in your GRC system, ServiceNow, or policy document.                                                                                   |

Only org admins can create or edit controls. **Tags** are added separately — from a control's detail page after it exists, or from the CLI with `kosli tag control CONTROL-IDENTIFIER --set key=value`. They're not part of the create form and don't create a new version.

Controls can also be managed from the command line, or programmatically through the controls API (`POST /api/v2/controls/{org}`). Create a control with `kosli create control` — `--name` is required and `--description` is optional:

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli create control RCTL-043 \
    --name "Source code review" \
    --description "All changes are reviewed by a second developer before release."
```

Set or change a control's name, description, or links with `kosli update control`. Each update creates a new version:

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli update control RCTL-043 \
    --description "All commits are reviewed by a second developer before release."
```

<Tip>
  Control identifiers are the stable identity that decisions and environment policies reference. Choose identifiers that match how your organization already refers to controls — for example, the identifiers in your ServiceNow or GRC system. If you use `RCTL-043` today, use exactly that.
</Tip>

### List your controls

Navigate to **Controls** in the [Kosli app](https://app.kosli.com) sidebar to browse your full controls catalog. Search by name or identifier, and filter by tag to narrow the list. Each control shows its identifier, description, tags, name, and current version.

Control definitions are versioned: each time you update a control's name, description, or links, a new version is created. This matters for audits — decisions recorded against a control always reference the exact version of the definition that was current when the decision was made, so the audit trail is precise even as controls evolve over time. A control's full version history is available on its **Versions** tab.

<Frame>
  <img alt="Controls catalog listing controls with their identifier, version, name, description, and tags, with a search box and tag-filter and sort controls" />
</Frame>

You can also list controls from the CLI with `kosli list controls`, fetch a single control with `kosli get control CONTROL-IDENTIFIER`, or use the controls API (`GET /api/v2/controls/{org}`).

### Archiving a control

When a control is retired, archive it rather than deleting it. Archiving moves the control out of the main catalog into its **Archived** view but preserves its full history — past decisions and every version of the definition remain intact for audit — and an archived control can be unarchived later if it comes back into use.

Archive or unarchive a control from its detail page (org admins only), from the CLI with `kosli archive control CONTROL-IDENTIFIER` and `kosli unarchive control CONTROL-IDENTIFIER`, or through the controls API (`POST /api/v2/controls/{org}/{identifier}/archive` and `.../unarchive`). Both actions appear as events in the control's **Versions** tab, alongside Created and Edited events, so the full lifecycle is auditable.

## Recording a decision against a control

A decision records the outcome of a PDP against a named control, scoped to a specific artifact. Use `--fingerprint` to identify the artifact the decision applies to — this is what allows `kosli assert artifact --environment` to later check that all required controls have passing decisions for that artifact specifically.

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli attest decision \
    --flow my-release-flow \
    --trail my-release-trail \
    --fingerprint "$ARTIFACT_FINGERPRINT" \
    --control RCTL-043 \
    --compliant=true \
    --name "source-code-review-decision" \
    --description "All 14 commits in this release have been reviewed by a second developer."
```

| Flag              | Description                                                                                                                                                                                                                                      |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `--control`       | **Required.** The control identifier this decision is recorded against.                                                                                                                                                                          |
| `--compliant`     | **Required.** Whether the control is satisfied. Boolean flag — pass `--compliant=true` or `--compliant=false`.                                                                                                                                   |
| `--fingerprint`   | The SHA256 fingerprint of the artifact this decision applies to. Scope decisions to an artifact so that assertions and environment policies can check compliance for that artifact specifically. Omit to record a trail-scoped decision instead. |
| `--artifact-type` | The artifact type (e.g. `docker`, `file`). Provide this with the artifact name/path as the command argument instead of `--fingerprint` to have Kosli calculate the fingerprint.                                                                  |
| `--name`          | The attestation slot name on the trail.                                                                                                                                                                                                          |
| `--description`   | Optional human-readable context for the decision.                                                                                                                                                                                                |
| `--attachments`   | Optional evidence file(s) to attach (e.g. an evaluation report, a REGO policy output).                                                                                                                                                           |
| `--user-data`     | Optional path to a JSON file containing additional structured data to attach to the attestation.                                                                                                                                                 |

The decision attestation goes on a trail, like any other attestation. It affects trail compliance: a `--compliant=false` decision makes the trail non-compliant. There are no restrictions on which flow or trail a decision can be recorded on — place it wherever makes sense in your process, typically at the point where the decision is actually being made (e.g. during a release preparation or promotion step). You can record multiple decisions for the same control on a trail; the most recent one is used when evaluating compliance.

<Info>
  A decision records the outcome of a PDP. How the PDP is implemented — running `kosli evaluate`, executing a custom script, or using a third-party tool — is up to you. `kosli attest decision` records the outcome; it does not make the decision for you.
</Info>

### Attaching evidence to a decision

Evidence attached to a decision explains *why* the decision was reached — not just that a control passed or failed, but what information was used to make that judgment. This is what auditors will ask for: the policy that was applied and the evaluation report that justified the outcome.

A natural source of evidence is a `kosli evaluate` report. `kosli evaluate` is a PDP: it runs a Rego policy against a trail's evidence and writes the allow/deny result to its output. By default it also asserts — exiting non-zero when the policy denies — so pass `--no-assert` when you want to capture the result and record it as a decision yourself rather than failing the step. The example below evaluates a trail, captures the full JSON report, reads the result, and records it as a decision. See [Evaluate trails with OPA policies](/tutorials/evaluate_trails_with_opa) for a full walkthrough of `kosli evaluate`.

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# Run the evaluation and save the full JSON report.
# --no-assert makes kosli evaluate exit 0 even when the policy denies,
# so the pipeline can read the result from the JSON output itself.
kosli evaluate trail "$TRAIL_NAME" \
    --policy supply-chain-policy.rego \
    --flow "$FLOW_NAME" \
    --no-assert \
    --output json > eval-report.json

# Read the allow/deny result from the report
is_compliant=$(jq -r '.allow' eval-report.json)

# Extract violations as structured user-data
jq '{violations: .violations}' eval-report.json > eval-violations.json

# Record the decision, attaching the policy and evaluation report as evidence
kosli attest decision \
    --flow "$FLOW_NAME" \
    --trail "$TRAIL_NAME" \
    --fingerprint "$ARTIFACT_FINGERPRINT" \
    --control RCTL-1866 \
    --compliant="$is_compliant" \
    --name supply-chain-integrity-decision \
    --attachments supply-chain-policy.rego,eval-report.json \
    --user-data eval-violations.json
```

This creates a decision attestation with:

* **`--attachments`** containing the Rego policy (for reproducibility) and the full JSON evaluation report
* **`--user-data`** containing the violations, which appear in the Kosli UI as structured metadata on the attestation
* **`--compliant`** set directly from the evaluation result

## Requiring decisions in flow templates

A [flow template](/template-reference/flow_template) defines which attestations a trail must have to be compliant. Because a decision is an attestation, you can make one a required part of a trail by adding an attestation of `type: decision`. The `name` must match the `--name` you record the decision under.

```yaml release-template.yml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
# yaml-language-server: $schema=https://docs.kosli.com/schemas/flow-template/v1.json
version: 1
trail:
  attestations:
  - name: source-code-review-decision
    type: decision
```

With this template, a trail is only compliant once a decision attestation named `source-code-review-decision` has been recorded on it. Use this when the decision is part of the trail's own definition of done — for example, a release trail that must carry a recorded judgment before it is considered complete.

Flow templates require *that a decision was recorded*; they do not tie it to a specific control identifier. To require a decision for a **named control**, use `for_control` in an [environment policy](#referencing-controls-in-environment-policies) instead. The two mechanisms complement each other: the flow template gates trail compliance, the environment policy gates what may run in an environment.

## Asserting artifact compliance

`kosli assert artifact --environment` is the Policy Enforcement Point (PEP). It checks that an artifact satisfies all requirements in the environment's attached policy — including any controls required via `for_control` rules — and exits non-zero if it doesn't. Use it as a pipeline gate before promoting an artifact to an environment.

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli assert artifact \
    --fingerprint "$ARTIFACT_FINGERPRINT" \
    --environment production
```

| Flag              | Description                                                                                                                                                                     |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--fingerprint`   | The SHA256 fingerprint of the artifact to assert.                                                                                                                               |
| `--artifact-type` | The artifact type (e.g. `docker`, `file`). Provide this with the artifact name/path as the command argument instead of `--fingerprint` to have Kosli calculate the fingerprint. |
| `--environment`   | **Required.** The Kosli environment whose attached policy the artifact is asserted against.                                                                                     |

If the artifact satisfies all policy requirements — including passing decisions for every listed control — the command exits 0. If not, the command exits non-zero and prints which requirements were not met, failing the pipeline step.

<Tip>
  `kosli attest decision` is the PDP: it records a judgment about a control. `kosli assert artifact --environment` is the PEP: it enforces that judgment as part of the environment policy. Keep them in separate pipeline steps — the PDP step is where evidence is evaluated and the outcome is recorded; the PEP step is where the pipeline gates on that recorded outcome.
</Tip>

## End-to-end pipeline flow

The sequence below shows a single artifact moving through a build trail and a release trail, with the compliance decision made at release time and enforced by the release controller checking the environment policy.

```mermaid theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
sequenceDiagram
    participant P as Pipeline
    participant K as Kosli

    rect rgb(220,235,255)
        Note over P,K: Build trail — flow: my-app, trail: build-123

        P->>K: "`kosli begin trail build-123 --flow my-app`"
        P->>K: "`kosli attest pullrequest github --flow my-app --trail build-123`"
        P->>K: "`kosli attest artifact artifact-a --artifact-type docker --flow my-app --trail build-123`"
    end

    rect rgb(255,235,215)
        Note over P,K: Release trail — flow: my-release, trail: release-456

        P->>K: "`kosli begin trail release-456 --flow my-release`"

        Note right of P: 🔵 PDP — evaluate RCTL-043
        P->>K: "`kosli evaluate trail release-456 --policy rctl-043.rego --flow my-release --no-assert --output json`"
        K-->>P: eval-report.json
        P->>K: "`kosli attest decision --flow my-release --trail release-456 --fingerprint $FP_A --control RCTL-043 --compliant=$IS_COMPLIANT --attachments eval-report.json`"
    end

    rect rgb(220,255,220)
        Note over P,K: Release Controller

        Note right of P: 🔴 PEP — assert artifact against environment policy
        P->>K: "`kosli assert artifact --fingerprint $FP_A --environment production`"
        K-->>P: exit 0
    end
```

## Referencing controls in environment policies

Environment policies define the requirements an artifact must satisfy before it can run in a given environment. You can require that specific named controls have a passing decision recorded — not just that the trail is generally compliant. This is the key distinction: rather than relying on trail compliance as a catch-all, you can make individual controls explicit policy gates.

```yaml prod-policy.yaml theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
_schema: https://docs.kosli.com/schemas/policy/v1
artifacts:
  provenance:
    required: true
  attestations:
    - type: decision
      for_control: RCTL-043
    - type: decision
      for_control: RCTL-1866
```

Each `attestations` rule with `type: decision` and a `for_control` identifier requires a compliant decision recorded for that control. The control must already exist in your organization — unlike recording a decision, a policy that references an unknown control identifier is rejected. With this policy in place, an artifact deployed to this environment will be marked **non-compliant** if a passing decision has not been recorded for each listed control on its trail. The artifact can still be deployed — Kosli records compliance state but does not block deployments by default. To gate deployments on compliance, use [`kosli assert`](/getting_started/enforce_policies) in your pipeline. This abstracts the policy from the specific tooling your pipelines use: instead of "has an attestation of type `snyk` with zero criticals", the policy expresses "control `RCTL-1866` has been satisfied" — and the decision attestation carries the evidence of how that judgment was reached.

For the complete policy syntax, including attestation requirements and exceptions, see the [Environment Policies](/getting_started/policies) page.

## Viewing a control

Navigate to **Controls** in the [Kosli app](https://app.kosli.com) and select a control to see its detail view. The header shows the identifier, current version, name, any links, description, and tags. Below it are three tabs: **Decisions**, **Coverage**, and **Versions**.

### Decisions

The Decisions tab is the default view. It lists every decision recorded against this control across all flows and trails, with the timestamp, the trail it was recorded on, the artifact fingerprint, and the outcome (compliant or non-compliant). Filter by outcome and flow, and sort by timestamp, to narrow the list.

<Frame>
  <img alt="Decisions tab for a control showing decisions with timestamp, compliant/non-compliant outcome, trail, and artifact fingerprint" />
</Frame>

Select a decision to open its detail, showing the trail and artifact it applies to, the origin URL, the user-data behind the judgment (such as the Rego evaluation result and the parameters it was run with), and any attached evidence files (such as the Rego policy).

<Frame>
  <img alt="Decision detail tray showing the trail, artifact, origin URL, user-data, and attached evidence file for a decision" />
</Frame>

### Coverage

The Coverage tab shows how widely this control is enforced across your environments. A control is **covered** in an environment when that environment has an active [policy](/getting_started/policies) whose latest version references this control through a `for_control` requirement — regardless of whether the policy is currently passing. Coverage measures *enforcement reach*, not compliance: an environment whose policy references the control but is currently failing still counts as covered, and the policy name is shown so you can investigate.

At the top, a progress bar summarizes coverage as a percentage and as `N of M environments`. Below it, each environment is listed with the policy that covers it and a **Covered** or **Not covered** badge. Filter the list by environment name, and use the **Status** filter to show all environments, only covered, or only not covered — handy for focusing on enforcement gaps.

<Frame>
  <img alt="Coverage tab for a control showing a coverage progress bar, a Status filter, and a list of environments each with the policy that covers it and a covered or not-covered badge" />
</Frame>

<Info>
  **Archived environments are excluded** from the coverage list and from the totals — they are not counted in `N of M`. Only active policies contribute to coverage: if a policy is archived or detached from an environment, that environment is no longer covered by it.
</Info>

Coverage is also available through the controls API: `GET /api/v2/controls/{org}/{identifier}/coverage` returns the summary (`total`, `covered`, `coverage_percent`) and a paginated list of environments, with name search and filtering by coverage state (`?covered=true` / `?covered=false`).

### Versions

The Versions tab lists every version of the control definition — the name, description, and links as they were at each version, with who made the change and when. Because every decision references the control version that was current when it was recorded, this history lets auditors see exactly what the control required at the time of each decision.

## What you've accomplished

You have learned how to define controls in Kosli, record decisions against them from pipelines using `kosli attest decision` as the PDP, require controls in environment policies with `for_control`, assert artifact compliance using `kosli assert artifact --environment` as the PEP, and review the decisions, coverage, and version history of each control.

Your controls catalog is now the bridge between the evidence Kosli collects and the requirements your auditors, control owners, and regulators care about. For each production change, you can now answer: "which of our controls have a compliant decision recorded, and which don't?"

From here you can:

* Learn more about [controls](/understand_kosli/controls)
* Learn more about [environment policies](/getting_started/policies)
* Learn more about [attestations](/getting_started/attestations)
* [Evaluate trails with Rego policies](/tutorials/evaluate_trails_with_opa) to automate decision-making


# AI access to these docs
Source: https://docs.kosli.com/understand_kosli/ai_docs_access

Use MCP servers, skill.md, and llms.txt to let AI tools read and search Kosli documentation.

Kosli documentation supports AI-friendly access through three mechanisms: an **MCP server** for semantic search, a **skill.md** endpoint that teaches AI assistants how the docs are organized, and **llms.txt** files that provide full documentation content. These let you query Kosli documentation directly from AI coding assistants like Cursor, Claude Code, Windsurf, VS Code with Copilot, and others.

<Note>
  Everything on this page covers access to the documentation. To let an AI assistant query the data in your own Kosli organization, see the [Kosli MCP server](/integrations/mcp_server).
</Note>

## MCP server

The Model Context Protocol (MCP) server lets AI tools search Kosli documentation semantically. Instead of copy-pasting docs into a chat window, you connect your AI assistant to the MCP endpoint and it can search the docs on its own.

**Endpoint:** `https://docs.kosli.com/mcp`

### Set up MCP in your AI tool

<Tabs>
  <Tab title="Cursor">
    Add the following to your `.cursor/mcp.json` file:

    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    {
      "mcpServers": {
        "kosli-docs": {
          "url": "https://docs.kosli.com/mcp"
        }
      }
    }
    ```
  </Tab>

  <Tab title="Claude Code">
    Run the following command:

    ```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    claude mcp add --transport http kosli-docs https://docs.kosli.com/mcp
    ```
  </Tab>

  <Tab title="Windsurf">
    Add the following to your `~/.codeium/windsurf/mcp_config.json` file:

    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    {
      "mcpServers": {
        "kosli-docs": {
          "type": "http",
          "url": "https://docs.kosli.com/mcp"
        }
      }
    }
    ```
  </Tab>

  <Tab title="VS Code (Copilot)">
    Add the following to your `.vscode/mcp.json` file:

    ```json theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    {
      "servers": {
        "kosli-docs": {
          "type": "http",
          "url": "https://docs.kosli.com/mcp"
        }
      }
    }
    ```
  </Tab>
</Tabs>

Once connected, your AI assistant gains a search tool it can use to look up Kosli concepts, CLI commands, API endpoints, and more — without you having to find and paste the relevant page.

### What you can do with it

* Ask "How do I attest a Snyk scan in a GitHub Actions workflow?" and get an answer grounded in the official docs.
* Look up Kosli CLI commands, API endpoints, or configuration options while coding.
* Get accurate, up-to-date answers without leaving your editor.

### Inline MCP access

Each documentation page also has a **Copy page** button in the top-right corner. Click it to access options like copying the page as Markdown for LLMs, opening it directly in ChatGPT, Claude, or Perplexity, copying the MCP server URL, or installing the MCP server in Cursor or VS Code.

## skill.md

The `skill.md` endpoint provides a structured overview of Kosli documentation that AI assistants can use to understand how the docs are organized and what topics they cover.

**Endpoint:** `https://docs.kosli.com/skill.md`

This is useful when you want an AI assistant to have a broad understanding of Kosli's documentation structure without loading every page. Your AI tool can read this file to learn:

* What Kosli is and what the docs cover.
* How the documentation is organized (sections, categories).
* Where to find specific topics.

### Use skill.md with Claude Code

To register the Kosli docs as a Claude Code skill, create the skill directory and download the file:

```bash theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
mkdir -p ~/.claude/skills/kosli-docs
curl -o ~/.claude/skills/kosli-docs/SKILL.md https://docs.kosli.com/skill.md
```

Claude Code auto-discovers skills from `~/.claude/skills/` and will reference the Kosli documentation during your sessions.

<Note>The local skills directory (`~/.claude/skills/`) is specific to Claude Code. Other AI tools can consume `skill.md` directly by fetching the URL — for example, by pasting it into a conversation or configuring the tool to read it as context.</Note>

## llms.txt

Kosli documentation also provides standard `llms.txt` files for AI consumption:

* **`https://docs.kosli.com/llms.txt`** — An index of all documentation pages with descriptions.
* **`https://docs.kosli.com/llms-full.txt`** — The full content of all documentation pages in a single file.

These follow the [llms.txt standard](https://llmstxt.org/) and can be used by any AI tool that supports it. Pass the URL to a tool that accepts an llms.txt source, or download the file and include it as context in your prompt.

## When to use each method

| Method         | Best for                                                                                                |
| -------------- | ------------------------------------------------------------------------------------------------------- |
| **MCP server** | Targeted questions while coding. Your AI assistant searches the docs and returns relevant answers.      |
| **skill.md**   | Giving an AI assistant a high-level understanding of what Kosli docs cover and how they are structured. |
| **llms.txt**   | Feeding full documentation content to an AI tool that supports the llms.txt standard.                   |


# Controls
Source: https://docs.kosli.com/understand_kosli/controls

Why SDLC controls exist, how they mitigate software delivery risks, and how Kosli implements them.

The [risks page](/understand_kosli/risks) describes what can go wrong in software delivery. A control is the counterpart: a repeatable, verifiable activity that mitigates one or more of those risks. Controls are what stand between an identified risk and a security or compliance incident.

The challenge is not defining controls (most teams already know what "good" looks like) but enforcing them consistently and proving they ran. Manual checklists drift, spreadsheets go stale, and tribal knowledge leaves with the people who hold it. Kosli automates the recording and enforcement of controls so you get continuous evidence that the right things happened.

## The SDLC control model

Controls are organized by the phase of the software delivery lifecycle where they apply:

<CardGroup>
  <Card title="Build controls" icon="hammer">
    Securing the build chain: dependency management, secrets scanning, artifact provenance, controlled build environments, infrastructure as code.
  </Card>

  <Card title="Release controls" icon="rocket">
    Validation before deployment: code review, quality assurance, vulnerability scanning, deployment approvals.
  </Card>

  <Card title="Runtime controls" icon="server">
    Monitoring and enforcement in production: change records, deployment controls, secrets management, workload monitoring, drift detection.
  </Card>

  <Card title="Lifecycle controls" icon="arrows-spin">
    Human and organizational factors: security training, penetration testing, service ownership.
  </Card>
</CardGroup>

<Tip>
  Kosli's [SDLC Controls Framework](https://sdlc.kosli.com) contains a rich catalog of controls with risk mappings. Your organization may define additional controls or adapt these to fit your specific compliance requirements.
</Tip>

## Example controls by phase

The following examples show representative controls from each phase, the risks they mitigate, and the Kosli concepts that implement them.

### <Icon icon="hammer" /> Build

Build controls secure the build chain itself. The reason these controls exist at the build phase (rather than later) is that a compromised dependency, an exposed secret, or an unverifiable artifact is cheapest to catch before it enters the release pipeline. Once a tainted artifact passes the build stage, every downstream control has to work harder to detect it.

| Control                    | Risk mitigated                                             | Kosli concept                 |
| -------------------------- | ---------------------------------------------------------- | ----------------------------- |
| Dependency management      | Supply chain compromise, Vulnerable software in production | Attestation (`snyk` type)     |
| Secrets scanning           | Credential and secret exposure                             | Attestation (custom type)     |
| Artifact binary provenance | Supply chain compromise                                    | Artifact (SHA256 fingerprint) |

### <Icon icon="rocket" /> Release

Release controls validate that software is ready for production. While build controls secure the ingredients, release controls verify the result: has the code been reviewed, do the tests pass, are there known vulnerabilities, and has someone authorized the deployment? The reason code review sits here (rather than in build) is that it is a validation of the change as a whole, not of the build toolchain.

| Control                | Risk mitigated                                             | Kosli concept                          |
| ---------------------- | ---------------------------------------------------------- | -------------------------------------- |
| Code review            | Insider threat, Unreviewed changes                         | Attestation (`pullrequest` type)       |
| Quality assurance      | Vulnerable software in production                          | Attestation (`junit` type)             |
| Vulnerability scanning | Vulnerable software in production, Supply chain compromise | Attestation (`snyk` type)              |
| Deployment approvals   | Unauthorized deployment                                    | Attestation (`generic` or custom type) |

### <Icon icon="server" /> Runtime

Runtime controls address what happens after deployment. Even if every build and release control passes, the production environment can still diverge from expectations. Configuration drift happens gradually as manual fixes accumulate. Shadow changes appear when someone bypasses the pipeline altogether. The reason runtime monitoring matters is that it closes the loop: you verify not just what you intended to deploy, but what is actually running.

| Control                     | Risk mitigated                          | Kosli concept                        |
| --------------------------- | --------------------------------------- | ------------------------------------ |
| Runtime workload monitoring | Shadow changes, Unauthorized deployment | Environment Snapshot                 |
| Drift detection             | Configuration drift                     | Environment Snapshot + notifications |
| Change records              | Lack of auditability                    | Trail                                |

### <Icon icon="arrows-spin" /> Lifecycle

Lifecycle controls address the human and organizational factors that underpin all other controls. While build, release, and runtime controls target specific phases, lifecycle controls ensure that teams have the knowledge, accountability, and validation processes to operate a secure SDLC. Without them, the technical controls may be in place but the people and processes behind them are fragile.

| Control             | Risk mitigated                    | Kosli concept             |
| ------------------- | --------------------------------- | ------------------------- |
| Security training   | Insider threat                    | Attestation (custom type) |
| Penetration testing | Vulnerable software in production | Attestation (custom type) |
| Service ownership   | Lack of auditability              | Trail                     |

## From controls to Kosli concepts

The controls above are abstract: they describe *what* needs to happen. Kosli provides the building blocks that *implement* them. The reason Kosli models controls this way (rather than, say, embedding them as pipeline plugins or CI-specific integrations) is that controls span tools and environments. A single control like "code review" might originate in GitHub, get recorded in a CI pipeline, and need to be verifiable months later during an audit. Kosli's model is designed to be tool-agnostic so that evidence from any source fits into the same structure.

Kosli organizes controls through a hierarchy. At the top is a **Flow**, which models a process that contains controls (your CI pipeline, your Terraform workflow, your onboarding procedure). Each time that process runs, it creates a **Trail**, a single execution that collects all the evidence for that run. The reason this layered approach matters is that a single attestation is meaningless without the context of which process produced it and which execution it belongs to.

Within a Trail, **Attestations** record that specific controls were executed and capture their results. A **Flow Template** defines which attestations are required for a Trail to be compliant. If a required attestation is missing, Kosli flags the Trail as non-compliant.

At the runtime level, **Environment Policies** enforce controls over what may run in production, and **Environment Snapshots** provide the data that makes runtime controls like drift detection possible. The reason Environments are modeled separately from Flows is that what you build and what you run are fundamentally different concerns. An artifact may pass every build and release control but still create a compliance problem if it appears in an environment where it does not belong.

To understand each of these building blocks in detail, continue to [How Kosli works](/understand_kosli/how_kosli_works).

<CardGroup>
  <Card title="How Kosli works" icon="cubes" href="/understand_kosli/how_kosli_works">
    Explore each building block and how they connect.
  </Card>

  <Card title="Build controls lab" icon="flask" href="/labs/lab-03-build-controls">
    See build controls in action through a hands-on lab.
  </Card>

  <Card title="Release controls lab" icon="flask" href="/labs/lab-04-release-controls">
    See release controls in action through a hands-on lab.
  </Card>

  <Card title="Runtime controls lab" icon="flask" href="/labs/lab-05-runtime-controls">
    See runtime controls in action through a hands-on lab.
  </Card>
</CardGroup>


# Glossary
Source: https://docs.kosli.com/understand_kosli/glossary

Quick-reference definitions of Kosli terms and concepts.

A reference list of Kosli terms. For a narrative explanation of how these concepts fit together, see [How Kosli works](/understand_kosli/how_kosli_works).

### Artifact

A software deliverable (binary, container image, archive) reported to Kosli and identified by its SHA256 fingerprint. Kosli uses the fingerprint to link an artifact's build-time origin to its runtime presence.

### Attestation

A record that a specific control or check was performed on an Artifact or Trail, along with its result. Built-in types include `snyk`, `junit`, `sonar`, `pullrequest`, and `generic`. Custom types support jq-based compliance evaluation.

### Audit Package

A downloadable tar file containing metadata and evidence for a Trail, Artifact, or Attestation. Used for audit investigations and compliance reviews.

### Binary Provenance

The chain of custody that links an artifact's fingerprint to its origin, build evidence, and runtime deployment history.

### Control

A repeatable, verifiable activity that mitigates one or more [risks](/understand_kosli/risks). Controls span build, release, runtime, and lifecycle phases.

### Environment

A Kosli representation of a runtime system you want to monitor (Kubernetes cluster, ECS service, Lambda function, S3 bucket, server directory, Docker host, Azure Web App).

### Environment Policy

A set of compliance requirements defining what may run in an Environment. Non-compliant artifacts are flagged. Trusted third-party artifacts can be allowlisted.

### Environment Snapshot

A point-in-time capture of the artifacts running in an Environment. Kosli traces each running artifact back to the Flow and Trail that produced it.

### Evidence Vault

Secure storage for evidence files attached to attestations (test reports, scan output, approval records). Retrievable on demand for audits.

### Flow

A model of a repeatable business or software process (e.g., a CI pipeline, a Terraform workflow) for which you want to track changes and monitor compliance.

### Flow Template

The compliance definition for a Flow. It specifies the artifacts and attestations that every Trail in the Flow must contain to be considered compliant. Each Trail can override its Flow's template.

### Organization

The account that owns Kosli resources (Flows, Environments, Policies). Most teams work within a shared organization that maps to their company. Members are invited with specific roles that control access.

### Risk

A condition or event in the software delivery lifecycle that could compromise the integrity, security, or compliance posture of your software.

### Trail

A single execution of a Flow (e.g., one CI build, one pull request). Each Trail has a unique identifier you choose, such as a git commit SHA or PR number.

### Trail Evaluation

The process by which Kosli checks a Trail against its Flow Template to determine whether all required artifacts and attestations are present and compliant.


# How Kosli works
Source: https://docs.kosli.com/understand_kosli/how_kosli_works

How Kosli models software delivery using Flows, Trails, Artifacts, Attestations, and Environments.

Kosli provides a set of building blocks that implement [controls](/understand_kosli/controls) across your software delivery lifecycle. This page explains what those building blocks are, why they exist, and how they fit together.

## Modeling your process: Flows, Trails, and Templates

Every process you want to track in Kosli starts with a **Flow**. A Flow models a repeatable process: a CI pipeline, a Terraform workflow, an onboarding procedure. It is the container for everything that happens within that process.

Each time the process runs, Kosli creates a **Trail**. A Trail represents one execution of a Flow: one CI build, one pull request, one infrastructure change. You choose the identifier (a git commit SHA, a PR number, a ticket ID) so that trails map naturally to your domain. The reason Kosli uses user-chosen identifiers rather than auto-generated IDs is that trails should map to concepts your team already works with, not introduce an opaque abstraction.

A **Flow Template** defines what "compliant" means for a given Flow. It lists the artifacts and attestations that every Trail must contain before Kosli considers it complete. This is how Kosli enforces [build and release controls](/understand_kosli/controls): if a required attestation is missing, the Trail is non-compliant.

## Recording evidence: Artifacts and Attestations

When your CI pipeline produces a binary, container image, or any other deliverable, you report it to Kosli as an **Artifact**. Kosli identifies each artifact by its SHA256 fingerprint rather than by name or tag. The reason for this design choice is that names and tags are mutable (a `latest` tag can point to different images over time), while a cryptographic fingerprint is immutable. This creates a tamper-proof reference that links the artifact's origin in a Trail to its runtime presence in an Environment.

An **Attestation** records that a specific control was executed and captures its result. When your pipeline runs a Snyk scan, that scan result becomes an attestation on the artifact or trail. When a pull request is reviewed, that review becomes an attestation. Attestations are the evidence that your controls actually ran.

Kosli provides built-in attestation types for common controls (Snyk, JUnit, SonarCloud, pull requests, approvals) and supports custom types with jq querying for compliance evaluation. You can also create generic attestations for controls that do not require automated evaluation.

Attestations can carry attached evidence files (test reports, scan output, approval records). Kosli stores these files in the **Evidence Vault**, making them retrievable on demand for audits or investigations.

## Monitoring runtime: Environments, Snapshots, and Policies

Kosli tracks what is running in your production (and non-production) systems through **Environments**. The reason Environments are modeled separately from Flows is that what you build and what you run are fundamentally different concerns that need independent tracking. Each physical or virtual runtime you want to monitor gets its own Kosli Environment: a Kubernetes cluster, an ECS service, a Lambda function, an S3 bucket, or a server directory.

Kosli supports periodic **Environment Snapshots** that capture the artifacts running at a point in time. For each artifact in a snapshot, Kosli traces it back to the Flow and Trail that produced it, creating a direct link between what was built and what is running. This is how Kosli implements [runtime controls](/understand_kosli/controls) like drift detection and shadow change identification.

An **Environment Policy** defines compliance requirements for what may run in an environment. If an artifact appears in a snapshot that does not satisfy the policy, Kosli flags it as non-compliant. Third-party artifacts that you trust but did not build yourself can be allowlisted.

## Audit readiness

A Trail collects all the attestations and artifacts for a single execution of your process. You can download an **Audit Package** for any Trail, Artifact, or individual Attestation to get a tar file containing the metadata and attached evidence files. This is your on-demand compliance record, ready for auditors or internal investigations.

## Organizations

A Kosli **Organization** is the account that owns all of these resources: Flows, Environments, Policies, and the evidence they contain. Organizations provide the access control boundary that determines who can view and modify compliance data. This matters because many of the [risks](/understand_kosli/risks) Kosli addresses (insider threat, unauthorized deployment) depend on controlling who has access to what.

Most teams work within a shared organization that maps to their company. Members are invited with specific roles that control what they can see and do.

## How the pieces connect

The diagram below shows how these building blocks relate to each other.

<Frame>
  <img alt="Diagram showing how Kosli concepts connect: a Flow executes as a Trail, which produces Artifacts and collects Attestations. Artifacts link via fingerprint to Environment Snapshots. Trails download as Audit Packages." />
</Frame>

An Organization contains Flows and Environments. When a Flow runs, it creates a Trail. The Trail produces Artifacts and collects Attestations, some of which can be attached to a specific Artifact. Meanwhile, Environment Snapshots capture what is actually running and link back to the Artifact and the Trail it was produced in. This connection between build-time evidence and runtime state is what gives Kosli end-to-end traceability.

## Get started

<CardGroup>
  <Card title="Create a Flow" icon="arrow-right" href="/getting_started/flows">
    Set up your first Flow and Trail.
  </Card>

  <Card title="Report Artifacts" icon="arrow-right" href="/getting_started/artifacts">
    Report artifacts and create attestations.
  </Card>

  <Card title="Report Environments" icon="arrow-right" href="/getting_started/environments">
    Monitor runtime environments and define policies.
  </Card>
</CardGroup>

<CardGroup>
  <Card title="Glossary" icon="book" href="/understand_kosli/glossary">
    Quick-reference definitions of every Kosli term.
  </Card>

  <Card title="Risks" icon="triangle-exclamation" href="/understand_kosli/risks">
    The SDLC risks these concepts are designed to address.
  </Card>

  <Card title="Controls" icon="shield-check" href="/understand_kosli/controls">
    How controls map to Kosli building blocks.
  </Card>

  <Card title="Learning Labs" icon="flask" href="/labs">
    Five hands-on labs covering the full Kosli workflow.
  </Card>
</CardGroup>


# Risks
Source: https://docs.kosli.com/understand_kosli/risks

Why modern software delivery introduces risks that are hard to manage, and how to think about them.

Software teams ship faster than ever. Code flows through automated pipelines, pulls in hundreds of open-source dependencies, and deploys to distributed infrastructure multiple times a day. That speed is a strength, but it also means that the number of places where something can go wrong has grown dramatically. A single compromised dependency, an unreviewed commit, or an unnoticed configuration change can reach production before anyone is aware of it.

The reason these risks are hard to manage is not that teams are careless. It is that the delivery process spans so many tools, environments, and people that no single person has full visibility. Evidence of what happened (and whether it should have happened) is scattered across CI logs, chat threads, ticketing systems, and cloud consoles. Reconstructing the full picture after an incident, or during an audit, is slow and unreliable.

## What is a risk?

In this context, a risk is a condition or event in your software delivery lifecycle (SDLC) that could compromise the integrity, security, or compliance posture of your software. These are not hypothetical. They reflect real-world incidents that have affected organizations across industries.

## The risk landscape

Kosli identifies nine categories of risk across the SDLC. They fall into three broad groups depending on where in the lifecycle they originate.

### <Icon icon="box-open" /> Risks from your supply chain and build process

Modern software is largely assembled, not written from scratch. Your application depends on libraries, base images, and build tools maintained by third parties. If any of those components are tampered with, malicious code enters your pipeline without anyone writing a single bad line. At the same time, the build process itself can introduce vulnerabilities if security scanning is skipped or secrets are accidentally embedded in artifacts.

| Risk                                  | Description                                                                                             |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| **Supply chain compromise**           | Third-party dependencies or build tools are tampered with, injecting malicious code into your software. |
| **Vulnerable software in production** | Known vulnerabilities ship to production because scanning was skipped, ignored, or incomplete.          |
| **Credential and secret exposure**    | Developers commit API keys, tokens, or passwords to source control or embed them in artifacts.          |

### <Icon icon="users" /> Risks from within your team

Not all risks come from outside. Authorized users can introduce problems too, whether through honest mistakes or deliberate circumvention of process. Code that skips peer review, deployments that bypass approval gates, and changes that no one documents all create gaps that are invisible until something breaks or an auditor asks questions.

| Risk                        | Description                                                                                                                                                                                                             |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Insider threat**          | Changes made using authorized credentials without proper review or approval. This includes mistakes by team members, deliberate circumvention of process, or third parties who have compromised legitimate credentials. |
| **Unauthorized deployment** | Software reaches production without passing required gates or approvals.                                                                                                                                                |
| **Unreviewed changes**      | Code or configuration changes bypass peer review, increasing the chance of defects or policy violations.                                                                                                                |
| **Lack of auditability**    | There is no reliable record of what changed, when, why, or by whom, making audits costly and unreliable.                                                                                                                |

### <Icon icon="server" /> Risks from your runtime environments

Once software is deployed, the runtime environment becomes its own source of risk. Configurations drift from their expected state, artifacts appear that cannot be traced back to any known build, and changes happen outside the deployment pipeline entirely. These "shadow changes" are particularly dangerous because they bypass every control you have put in place during build and release.

| Risk                    | Description                                                                                       |
| ----------------------- | ------------------------------------------------------------------------------------------------- |
| **Configuration drift** | Production environments diverge from their expected state without anyone noticing.                |
| **Shadow changes**      | Changes appear in production that cannot be traced back to any known build or deployment process. |

<Tip>
  Kosli's [SDLC Controls Framework](https://sdlc.kosli.com) organizes these nine risks with detailed descriptions and risk-to-control mappings. Your organization may identify additional risks or prioritize them differently depending on your industry, regulatory environment, and threat model.
</Tip>

## Risks and compliance frameworks

These risks are not unique to Kosli. They are the same concerns addressed by compliance frameworks like SOC 2, ISO 27001, and FDA 21 CFR Part 11. Each framework codifies requirements for managing some or all of these risks through documented controls and evidence. For example, SOC 2's Change Management criteria address unauthorized deployment and unreviewed changes, while its Logical Access controls relate to insider threat and credential exposure.

Kosli does not replace a compliance framework. The reason it is designed this way is that frameworks define *what* you must demonstrate, while Kosli automates *how* you demonstrate it. The alternative (building compliance tooling into each framework individually) would mean duplicating effort across SOC 2, ISO 27001, and every other standard your organization adopts. Kosli instead provides a single evidence layer that serves all of them. When your CI pipeline attests that a security scan passed, or Kosli detects unexpected changes in a production environment, that is compliance evidence recorded automatically. Without Kosli, producing and maintaining that evidence requires manual effort, and manual evidence has a tendency to be incomplete, inconsistent, or simply missing when you need it most.

Now that you understand what can go wrong, the next step is understanding the [controls](/understand_kosli/controls) that prevent it and how Kosli implements them.


# What is Kosli?
Source: https://docs.kosli.com/understand_kosli/what_is_kosli

Why compliance automation matters and how Kosli approaches it.

Proving compliance in fast-moving software delivery is hard. Evidence is scattered across tools, audits are manual, and changes happen faster than any spreadsheet or CAB meeting can track. Kosli automates this. It is a tool-agnostic platform that integrates with your existing CI systems, scanners, and runtime environments, consolidating compliance data into a single place.

## Kosli in a nutshell

Think of Kosli as a flight recorder for your software delivery lifecycle (SDLC). Like a flight recorder, Kosli does not control the plane. It records what happened so that after the fact you can reconstruct the sequence of events. The reason this matters in software is that incidents and audit questions are inevitable, but the ability to answer "what was running, how did it get there, and did it pass all required checks?" should not depend on someone's memory or a manual audit trail.

You report events of interest (builds, test results, deployments, environment state) through the [CLI](/client_reference) or [API](/api-reference/actions/list-actions). Kosli stores each record as an immutable entry and evaluates it against the [controls](/understand_kosli/controls) defined in your policies. Change sources include build systems (CI pipelines), runtime environments (Kubernetes clusters, AWS ECS, Lambda), and business processes (onboarding, access management).

<Frame>
  <img alt="Diagram showing how Kosli records events from CI pipelines, runtime environments, and business processes into immutable audit trails." />
</Frame>

## When to use Kosli

* **Compliance automation**: Traditional compliance evidence collection is manual, error-prone, and always playing catch-up with the pace of delivery. Kosli automates evidence collection for frameworks like SOC 2, ISO 27001, or NIST SP 800-53, verifying that artifacts in production have passed required controls (security scans, code review, approval workflows) so you stay audit-ready at all times.
* **Change observability**: In distributed systems, understanding what changed, when, and by whom often requires piecing together logs from half a dozen tools. Kosli provides a unified view of change across your entire delivery pipeline, even without specific compliance requirements.

## Where to go next

<AccordionGroup>
  <Accordion title="New to Kosli?" icon="graduation-cap">
    Read [Risks](/understand_kosli/risks), [Controls](/understand_kosli/controls), and [How Kosli works](/understand_kosli/how_kosli_works) in order. Use the [Glossary](/understand_kosli/glossary) as a reference along the way. When you are ready to try it hands-on, work through the [Learning Labs](/labs).
  </Accordion>

  <Accordion title="Setting up Kosli for your team?" icon="users">
    Head to [Getting Started](/getting_started/install) for step-by-step setup, or see the [Implementation Guide](/implementation_guide/phase_1/roles_and_responsibilities/overview) for organizational rollout planning.
  </Accordion>

  <Accordion title="Looking up a specific term?" icon="magnifying-glass">
    See the [Glossary](/understand_kosli/glossary) for quick-reference definitions of every Kosli term.
  </Accordion>
</AccordionGroup>


# Default organization
Source: https://docs.kosli.com/user/default_organization

Pick which Kosli organization the app opens to when you sign in.

If you belong to more than one Kosli organization, you can pick a default. The Kosli app will open to that organization each time you sign in.

## Set your default organization

<Steps>
  <Step title="Open your profile settings">
    Go to your profile settings page:

    * EU: [app.kosli.com/settings/profile](https://app.kosli.com/settings/profile)
    * US: [app.us.kosli.com/settings/profile](https://app.us.kosli.com/settings/profile)
  </Step>

  <Step title="Choose a default organization">
    Under **Default organization**, select the organization you want to use as your default.
  </Step>
</Steps>

The change takes effect on your next sign-in. You can still switch between organizations from the organization picker at any time.

You can also set your default organization via the [API](/api-reference/user/set-default-organization).


# Personal API keys
Source: https://docs.kosli.com/user/personal_api_keys

Create and manage personal API keys tied to your Kosli user account.

A personal API key authenticates as **you**. It inherits your permissions across every organization you belong to.

<Warning>
  For CI/CD pipelines and any other automation, use a [service account](/administration/authentication/service_accounts) instead. Service account keys are scoped to a single organization, have an explicit role, and produce cleaner audit trails.
</Warning>

## Create a personal API key

<Steps>
  <Step title="Open your profile">
    From the user menu in the top-right corner of the Kosli app, click **Profile**:

    * EU: [app.kosli.com/settings/profile](https://app.kosli.com/settings/profile)
    * US: [app.us.kosli.com/settings/profile](https://app.us.kosli.com/settings/profile)
  </Step>

  <Step title="Add an API key">
    In the **API keys** section, click **Add API key**. Choose a Time-To-Live (TTL), add a descriptive label, and click **Add**.
  </Step>

  <Step title="Copy the key immediately">
    Kosli stores only a cryptographic hash of the token. The original value is shown once and cannot be retrieved later.
  </Step>
</Steps>

## Use the key

The same usage applies as for service account keys — see [Authenticating to Kosli](/getting_started/authenticating_to_kosli#use-the-token).

## Revoke a key

To revoke a personal API key, open **Profile → API keys**, find the key, and click **Revoke**. The key stops working immediately.