[github-actions]

Automated update of CLI and Helm reference documentation for release v2.56.0.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
kosli	🟢 Ready	View Preview	Nov 12, 2026, 5:21 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[claude]

Claude finished @github-actions[bot]'s task in 1m 0s —— View job

---

Doc review: CLI and Helm reference for v2.56.0

• Read the diff and every changed file at the branch head
• Check navigation, links and redirects
• Compare hand-written pages with the new reference pages
• Post the review

All four new pages (kosli attest in-toto, kosli dismiss product-updates, kosli list audit-logs, kosli list product-updates) are listed in config/navigation.json under Reference ▸ CLI Reference. Nothing was renamed or deleted, so no redirects are needed. The internal link targets on the new pages exist, including /getting_started/install#assigning-flags-via-environment-variables. The changes to kosli_get_environment, kosli_list_environments, kosli_list_flows, kosli_list_snapshots, kosli_fingerprint and kosli_evaluate_input are only regenerated sample data: timestamps, durations, compliance state and example commit SHAs.

administration/managing_users/membership_audit_log.md

Improvement

• Location: administration/managing_users/membership_audit_log.md:8-41
• Issue: v2.56.0 adds kosli list audit-logs, which reads the same membership audit log. This page is the only guide to that log, and it covers only the Audit Log page in the app, so an admin who wants to script an access review won't find the CLI command.
• Recommendation: Add a short "List changes from the CLI" section that links to /client_reference/kosli_list_audit-logs. Explain how the page's filters map to CLI flags: --search, --event-type, --role and --source, where --role and --source can be repeated. Also say that the CLI has no date-range filter, unlike the page's Timestamp filter. Fix this →

Upstream: does not block this merge

These pages are generated, so fix the source in kosli-dev/cli. An edit made here would be overwritten by the next release.

Suggestion

• Location: client_reference/kosli_attest_in-toto.md:50-57 and the same paragraph in client_reference/kosli_attest_sbom.md
• Issue: The paragraph names two TUF hosts (tuf-repo-cdn.sigstore.dev and tuf-repo.github.com) and then says the runner "needs outbound HTTPS to that host". Someone writing a firewall allowlist can't tell which host to allow. For private-repo attestations on GitHub, they could allow only the Sigstore host, and verification would then fail.
• Recommendation: Rewrite the sentence along these lines: "the runner needs outbound HTTPS to the host for the instance that signed it (both, if you verify attestations from both)". Fix it in the shared long-description text in cmd/kosli/attestInToto.go and cmd/kosli/attestSbom.go.

Totals: 0 critical, 1 improvement, 1 upstream suggestion. This review is advisory, and nothing here blocks the merge.