From f0c09d7edb5122d8b6e4272b8b861354e58f41e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dan=20Gr=C3=B8ndahl?= Date: Mon, 16 Mar 2026 16:27:58 +0100 Subject: [PATCH 1/2] docs: add schema comment and template reference callout to attestations example --- getting_started/attestations.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/getting_started/attestations.md b/getting_started/attestations.md index a273e29..55e7a85 100644 --- a/getting_started/attestations.md +++ b/getting_started/attestations.md @@ -17,6 +17,7 @@ Let's take a look at this example to understand how to make attestations to Kosl The following compliance template is expecting 4 attestations, each with its own `name`. ```yml +# yaml-language-server: $schema=https://kosli.mintlify.app/schemas/flow-template.json version: 1 trail: attestations: @@ -31,6 +32,10 @@ trail: type: snyk ``` + + See the [Flow Template reference](/template-reference/flow_template) for the full specification, available attestation types, and editor validation with JSON Schema. + + It expects `jira-ticket` on the trail, the `backend` artifact, with `unit-tests` and `security-scan` attached to it. When you make an attestation, you have the choice of what `name` to attach it to. From a8647968f638e60f5da1060506bdfbf22dfeff5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dan=20Gr=C3=B8ndahl?= Date: Mon, 16 Mar 2026 16:33:00 +0100 Subject: [PATCH 2/2] docs: improve attestations page step titles and callout style --- getting_started/attestations.md | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/getting_started/attestations.md b/getting_started/attestations.md index 55e7a85..5f2f6cf 100644 --- a/getting_started/attestations.md +++ b/getting_started/attestations.md @@ -44,7 +44,7 @@ When you make an attestation, you have the choice of what `name` to attach it to The following sections show how to make each of the four attestations defined in the template above. - + The `jira-ticket` attestation belongs to a single trail and is not linked to a specific artifact. In this example, the id of the trail is the git commit. ```shell @@ -55,7 +55,7 @@ The following sections show how to make each of the four attestations defined in ... ``` - + Some attestations are attached to a specific artifact, like the unit tests for the `backend` artifact. Often, evidence like unit tests are created _before_ the artifact is built. To attach the evidence to the artifact before its creation, use `backend` (the artifact's `name` from the template), as well as `unit-tests` (the attestation's `name` from the template). ```shell @@ -68,7 +68,7 @@ The following sections show how to make each of the four attestations defined in This attestation belongs to any artifact attested with the matching `name` from the template (in this example `backend`) and a matching git commit. - + Once the artifact has been built, it can be attested with the following command. ```shell @@ -82,13 +82,11 @@ The following sections show how to make each of the four attestations defined in In this case the Kosli CLI will calculate the fingerprint of the docker image called `my_company/backend:latest` and attest it as the `backend` artifact `name` in the trail. - - - In all attestation commands the Kosli CLI will automatically gather the git commit and other information from the current git repository and the [CI environment](https://docs.kosli.com/integrations/ci_cd/). - This is how the git commit is used to match attestations to artifacts. - + + In all attestation commands the Kosli CLI automatically gathers the git commit and other information from the current git repository and the [CI environment](https://docs.kosli.com/integrations/ci_cd/). This is how the git commit is used to match attestations to artifacts. + - + Often, evidence like snyk reports are created _after_ the artifact is built. In this case, you can attach the evidence to the artifact after its creation. Use `backend` (the artifact's `name` from the template), as well as `security-scan` (the attestation's `name` from the template) to name the attestation. The following attestation will only belong to the artifact `my_company/backend:latest` attested above and its fingerprint, in this case calculated by the Kosli CLI.