docs: update CLI and helm reference for v2.48.0

client_reference/kosli_assert_pullrequest_azure.md

@@ -12,6 +12,8 @@ kosli assert pullrequest azure [flags]
 Assert an Azure DevOps pull request for a git commit exists.  
 The command exits with non-zero exit code 
 if no pull requests were found for the commit.
+No local git repository is needed: `--commit` is looked up through the git provider's API.
+Outside a supported CI, set `--commit` to a full commit SHA: its `HEAD` default is not read from your local checkout.
 
 ## Flags
 | Flag | Type | Description |

client_reference/kosli_assert_pullrequest_bitbucket.md

@@ -13,6 +13,8 @@ Assert a Bitbucket pull request for a git commit exists.
 The command exits with non-zero exit code if no pull requests were found for the commit.
 Authentication to Bitbucket can be done with an access token (recommended) or an Atlassian API token, passed via --bitbucket-username (your Atlassian account email) and --bitbucket-password.
 Bitbucket app passwords are no longer supported as of 28 July 2026; replace any app passwords with API tokens. Credentials need to have read access for both repos and pull requests.
+No local git repository is needed: `--commit` is looked up through the git provider's API.
+Outside a supported CI, set `--commit` to a full commit SHA: its `HEAD` default is not read from your local checkout.
 
 ## Flags
 | Flag | Type | Description |

client_reference/kosli_assert_pullrequest_github.md

@@ -12,6 +12,8 @@ kosli assert pullrequest github [flags]
 Assert a Github pull request for a git commit exists.  
 The command exits with non-zero exit code
 if no pull requests were found for the commit.
+No local git repository is needed: `--commit` is looked up through the git provider's API.
+Outside a supported CI, set `--commit` to a full commit SHA: its `HEAD` default is not read from your local checkout.
 
 ## Flags
 | Flag | Type | Description |

client_reference/kosli_assert_pullrequest_gitlab.md

@@ -12,6 +12,8 @@ kosli assert pullrequest gitlab [flags]
 Assert a Gitlab merge request for a git commit exists.  
 The command exits with non-zero exit code 
 if no merge requests were found for the commit.
+No local git repository is needed: `--commit` is looked up through the git provider's API.
+Outside a supported CI, set `--commit` to a full commit SHA: its `HEAD` default is not read from your local checkout.
 
 ## Flags
 | Flag | Type | Description |

client_reference/kosli_attest_artifact.md

@@ -42,7 +42,10 @@ The `.kosli_ignore` file is always treated as part of the artifact: its own entr
 Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible.
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
-This command requires access to a git repo to associate the artifact to the git commit it is originating from.
+
+This command always requires access to a git repository to associate the artifact to the git commit it originates from.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory. `--commit` defaults to the CI commit in some CIs, otherwise to HEAD.
+The command fails if no repository is found at `--repo-root`, even when `--fingerprint` is given.
 You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
@@ -54,7 +57,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--annotate` | stringToString | [optional] Annotate the attestation with data using key=value. |
 | `-t`, `--artifact-type` | string | The type of the artifact to calculate its SHA256 fingerprint. One of: [oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it). |
 | `-b`, `--build-url` | string | The url of CI pipeline that built the artifact. (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `-g`, `--commit` | string | [defaulted] The git commit from which the artifact was created. (defaulted in some CIs: [docs](/integrations/ci_cd), otherwise defaults to HEAD ). (default "HEAD") |
+| `-g`, `--commit` | string | [defaulted] The git commit from which the artifact was created. (defaulted in some CIs: [docs](/integrations/ci_cd), otherwise defaults to HEAD ). The commit is read from the git repository at `--repo-root`. (default "HEAD") |
 | `-u`, `--commit-url` | string | The url for the git commit that created the artifact. (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-N`, `--display-name` | string | [optional] Artifact display name, if different from file, image or directory name. |
 | `-D`, `--dry-run` | bool | [optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
@@ -71,7 +74,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |

client_reference/kosli_attest_custom.md

@@ -26,10 +26,13 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
-You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
-You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
+You can optionally associate the attestation to a git commit using `--commit`.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory. Without `--commit`, no git repository is needed.
+If `--commit` is only defaulted from CI and `--repo-root` is left at `.`, a missing repository or commit
+prints a warning and the attestation is sent without commit info.
 Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
 binding the attestation to the right artifact.
+You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
 In other CI systems, set them explicitly to capture repository metadata.
@@ -58,7 +61,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |

client_reference/kosli_attest_decision.md

@@ -32,10 +32,13 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
-You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
-You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
+You can optionally associate the attestation to a git commit using `--commit`.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory. Without `--commit`, no git repository is needed.
+If `--commit` is only defaulted from CI and `--repo-root` is left at `.`, a missing repository or commit
+prints a warning and the attestation is sent without commit info.
 Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
 binding the attestation to the right artifact.
+You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
 In other CI systems, set them explicitly to capture repository metadata.
@@ -65,7 +68,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |

client_reference/kosli_attest_generic.md

@@ -23,10 +23,13 @@ Paths the list already matches stay excluded whatever is later added there, so k
 Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again.
 To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it.
 
-You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo).
-You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
+You can optionally associate the attestation to a git commit using `--commit`.
+The commit is read from the git repository at `--repo-root`, which must be the repository's top-level directory. Without `--commit`, no git repository is needed.
+If `--commit` is only defaulted from CI and `--repo-root` is left at `.`, a missing repository or commit
+prints a warning and the attestation is sent without commit info.
 Note that when the attestation is reported for an artifact that does not yet exist in Kosli, `--commit` is required to facilitate
 binding the attestation to the right artifact.
+You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`.
 To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together.
 These are automatically set in GitHub Actions, GitLab CI, Bitbucket Pipelines, and Azure DevOps.
 In other CI systems, set them explicitly to capture repository metadata.
@@ -55,7 +58,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `--registry-username` | string | [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper. |
 | `--repo-id` | string | [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repo-provider` | string | [optional] The source code hosting provider. One of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server, git, subversion (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
-| `--repo-root` | string | [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
+| `--repo-root` | string | [defaulted] The directory where the source git repository is available. It must be the repository's top-level directory. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".") |
 | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). |
 | `-T`, `--trail` | string | The Kosli trail name. |