Skip to content

docs: update CLI and helm reference for v2.39.1 - #375

Merged
mbevc1 merged 1 commit into
mainfrom
reference-docs/v2.39.1
Aug 30, 2026
Merged

docs: update CLI and helm reference for v2.39.1#375
mbevc1 merged 1 commit into
mainfrom
reference-docs/v2.39.1

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Automated update of CLI and Helm reference documentation for release v2.39.1.

@mintlify

mintlify Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated (UTC)
kosli 🟢 Ready View Preview Aug 30, 2026, 2:12 PM

@claude

claude Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Claude encountered an error after 3m 21s —— View job


Doc review — v2.39.1 reference regeneration

  • Gather context (CLAUDE.md, doc-review skill, PR diff)
  • Review changed client_reference/ pages
  • Check frontmatter, links, and navigation requirements
  • Post review findings

Verdict: looks good to merge. No Critical findings. This is a machine-generated reference refresh — 12 of the 14 files are pure fixture churn (timestamps, snapshot indices, fingerprints, commit SHAs from the cyber-dojo demo org). Only three files carry real content changes, and all three are improvements.


Critical

None.

Checks run against this repo's CLAUDE.md:

Rule Result
New pages registered in config/navigation.json n/a — all 14 files MODIFIED, no additions
No relative links (../foo) ✅ 0 added relative links across the diff
Frontmatter present on every page ✅ untouched, intact
Code fences balanced ✅ all 13 content files have an even fence count
Version stamp consistent client_reference/overview.md:7 correctly bumped v2.39.0v2.39.1; no other file in the repo pins a CLI version

Improvement

client_reference/kosli_attest_jira.md:45-49 — the rewritten Jira-error paragraph is the one substantive prose change and has four readability issues: may not view is ambiguous between permission and possibility; the "because Jira answers 404" clause explains the permission case but is attached to the wrong-base-URL case; --jira-base-url is no longer named even though the old text named it; and three distinct failure outcomes are packed into one paragraph where a list would scan better. Details inline →

client_reference/kosli_attest_sonar.md:19,28,85overriden should be overridden (3 occurrences, one directly adjacent to a changed line). Details inline →

client_reference/kosli_attest_jira.md:19recognised is a British spelling and violates styles/Kosli/AmericanSpelling.yml. Pre-existing from v2.39.0, not introduced here, but it will keep shipping until the upstream string is fixed.

client_reference/kosli_attest_jira.md:53so you can select the once you needthe ones you need. Also pre-existing.

All four of the above live in generated pages. Per the Live docs section of CLAUDE.md, they must be fixed in the CLI's command long-descriptions in kosli-dev/cli — editing them here would be silently reverted by the next update-cli-docs.yml run. I've deliberately not included "Fix this" links for them, since a fix in this repo would be the wrong fix.


Suggestion

PR title — "update CLI and helm reference" but no helm/ files changed this run. Harmless (the workflow uses a fixed title), but a title that reflected the actual scope would make the history easier to scan.

Two changes worth calling out as clearly good:

  • kosli_create_attestation-type.md:87^jq^`jq` fixes a broken escape that was rendering literal carets in the Accordion title. Now consistent with the three equivalent titles in kosli_fingerprint.md.
  • kosli_snapshot_azure.md:22honoursrespects resolves an American-spelling violation.

Notes on verification

  • Not run: mint broken-links and Vale — neither CLI is available in this sandbox, and shell permissions blocked the fallback checks. Recommended if you want belt-and-braces, though the risk is low: no internal links were added or changed anywhere in the diff.
  • Not machine-validated: JSON parseability of the regenerated example payloads (the python3 validation call was blocked by sandbox permissions). Fence counts are balanced and the diffs are structurally consistent, so this is very likely fine — but it's an assumption, not a verified fact. Worth adding a JSON-parse assertion to the tests/ suite so future regenerations catch a malformed payload automatically.
  • Spot-checked: the kosli_list_flows.md diff looks alarming around line 533 (a repo_url appears to flip from runner to web) but this is diff misalignment from a new alphabetically-sorted terraform-apply-prod-runner entry being inserted. Read in full, terraform-apply-prod-aws-prod-co-promotionweb and terraform-apply-prod-runnerrunner are both correct.

Top 3 priorities (all upstream in kosli-dev/cli, none blocking this merge): 1. tighten the Jira error paragraph; 2. fix overriden; 3. fix recognised / the once you need.
· reference-docs/v2.39.1

Comment on lines +45 to +49

A reachable but wrong base URL still surfaces as a non-existent issue, because Jira answers 404
both for an issue that does not exist and for one you may not view. A base URL that cannot be
reached is reported as not confirmed, with the transport error as the reason. A credential
rejection is likewise detected and reported as not confirmed, with a warning identifying the

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Improvement — this rewritten paragraph is the only substantive prose change in the PR, and a few things read ambiguously for a reference page:

  1. for one you may not viewmay not is ambiguous between permission and possibility. one you do not have permission to view is unambiguous.
  2. The causal link is loose. The sentence claims a wrong base URL surfaces as a non-existent issue because Jira 404s for both "issue missing" and "issue not visible". Those two 404 cases explain the permission scenario, not the wrong-base-URL scenario. Splitting them would be clearer.
  3. The flag isn't named. The previous text said "wrong Jira-base-url"; the new text only says "base URL". On a lookup-oriented reference page, naming --jira-base-url (documented at line 93) helps readers connect the prose to the flag.
  4. Three distinct outcomes in one paragraph. Reachable-but-wrong URL → reported missing; unreachable URL → not confirmed + transport error; rejected credentials → not confirmed + warning. A short list would be easier to scan than prose.

⚠️ These files are generated (see scripts/ and the Live docs section of CLAUDE.md), so any wording fix has to land in the CLI's long-description in kosli-dev/cli — not here. Non-blocking for this release PR.

Comment on lines +29 to +30
If the scan ran on a branch other than the project's main branch in SonarQube, also provide the branch name using the `--sonar-branch` flag.
SonarQube only searches the project's main branch unless told otherwise, so without this flag the scan cannot be found.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion — the rewrite here is an improvement (splitting the run-on into two sentences and dropping the dangling colon). Two pre-existing issues in the same paragraph that are worth fixing upstream while this text is being touched:

  • Line 28 (and lines 19, 85): overridenoverridden.
  • The sentence still says "the project's main branch in SonarQube" then repeats "the project's main branch" immediately after. Dropping the repetition would tighten it.

Generated file — fix in kosli-dev/cli, not in this PR.

@mbevc1
mbevc1 merged commit 628d6cf into main Aug 30, 2026
5 of 6 checks passed
@mbevc1
mbevc1 deleted the reference-docs/v2.39.1 branch August 30, 2026 17:46
dangrondahl added a commit that referenced this pull request Sep 3, 2026
Reviewed the last 20 non-bot PRs (14 touched docs) against what
`doc-write` and `doc-review` actually ask for, then fixed what the
record showed was wrong. No site content changes — this is all agent
tooling.

## Why

`doc-review` produced **0 Critical, 5 Improvement and ~20 Suggestion**
findings across those 14 PRs. Its genuinely valuable catches were all
cross-file consistency checks the skill never asked for:

- a changelog entry documenting `kosli update attestation-type`, a
command with no reference page (#371)
- `template-reference/flow_template.md` out of sync with the schema the
same PR regenerated (#296)
- the one file an approvals-removal sweep missed,
`understand_kosli/how_kosli_works.md:22` (#345)

Its weakest findings were prose polish, some already fixed at branch
head. Meanwhile its written checklist was dominated by things that
always pass or are already enforced by `vale-spellcheck`.

Two structural gaps the PR record made obvious:

- **Placement was never questioned.** In #305 a pure reference page was
authored into `integrations/`, and a human reviewer had to ask for the
move — commit `9e7a121 docs: move GitHub Action reference into the
Reference section`. That question should come from the review.
- **Generated pages were handled inconsistently.** #375 got it right and
said so. #374 wrote *"the durable fix is in the `kosli-dev/cli`
generator — a hand-edit here is overwritten by the next release"* and
then emitted a `Fix this` link scoped to `repo=kosli-dev/docs` telling
an agent to edit the generated file anyway, plus 4 inline comments on
regenerated files.

## What changed

**`doc-review`** — promoted the three accidental wins to named checks,
each carrying its precedent. Added placement, redirects and anchor
stability. Added an explicit *what not to report* bar and an 8-finding
cap. Stopped hand-checking spelling. Dropped the "what looks good"
recital that the sticky comment re-renders on every push.

**Generated pages** — split into three categories rather than one
blanket ban: deterministically regenerated (edit is deleted),
agent-synced (edit survives but drifts), and hand-authored despite the
directory (`client_reference/overview.md`, `output_and_verbosity.md`).
Includes the filename→source mapping, verified upstream:
`kosli_attest_sonar.md` ← `cmd/kosli/attestSonar.go`.

Also records that **`^` is the CLI's backtick convention** in Go long
descriptions, substituted by `kosli docs`. That makes the `^jq^` defect
#374 found a generator escaping bug in the Accordion-title path, not a
typo in the Go string — so a reviewer can point at the right fix. Worth
filing upstream separately.

**`doc-write`** — added a Diátaxis→tab placement table so #305 can't
recur, plus redirects, anchor stability, and the generated-paths table.

**New `doc-structure` skill + monthly workflow** — audits navigation
shape and changelog coverage, which per-PR review structurally cannot
see, and files issues. Read-only against docs; issues are its only
write. Capped at 8 issues, deduplicating against open issues first — its
headline check reproduces the `/getting_started/attestations` summary
gap, which is already open as #364.

**New `scripts/audit_navigation.py` + 22 tests** — the audit's
mechanical checks, extracted from an inline heredoc. Three payoffs:

1. `pr-quality.yml` already runs `pytest tests/`, so **CLAUDE.md core
rule 2 is now enforced deterministically** — a page file with no
`navigation` entry fails the build. No new job needed.
2. `doc-structure.yml` can allow `Bash(python3
scripts/audit_navigation.py:*)` instead of `Bash(python3:*)`, which was
arbitrary code execution.
3. Determinism. The inline version had already shipped a bug: `sed
's|\.mdx\?$||'` is a no-op on BSD sed, so every page looked orphaned on
macOS. That case is now a regression test.

Integrity findings (orphans, dangling entries) are separated from shape
findings (single-child groups, deep nesting, Title Case labels,
oversized groups, inconsistent icons). Only integrity can fail a build —
the script cannot tell a group that should be merged from one
deliberately kept separate.

`Reference ▸ CLI Reference` is exempt from shape checks:
`update-cli-nav.py` generates it from the CLI's command tree, so a
single-child `kosli allow` group is upstream truth. Without that
exemption the audit reported 54 findings, 21 of them proposing to
reshape generated navigation — the same mistake being fixed in
`doc-review`. It now reports 33, all hand-maintained.

**New `docs-restructure` issue template** — Markdown, not a YAML form:
`gh issue create --body` doesn't apply templates mechanically and YAML
forms can't be filled from the CLI, so a form would help humans and do
nothing for the job. Its URL-impact section encodes the distinction that
decides whether a restructure is safe — a group rename changes no URLs,
a moved page file needs a `config/redirects.json` entry. `config.yml`
keeps blank issues enabled.

**`CLAUDE.md`** — documented the six automated PR checks, the
generated-page source map, the audit script, and the three skills.
Removed the pointer to a `changelog-creator` skill that doesn't exist in
this repo.

## Anti-rot pass

Swept all three skills for dated claims. Counts ("three of the last
fourteen PRs") and current-state assertions ("link-rot reports skipping
on most PRs") became durable rules. The link-rot guidance now routes
through `gh pr checks` so it self-heals if Mintlify starts running it
reliably. Past-tense `Precedent:` items were kept — they're what make
the checks concrete.

## Verification

- `python3 -m pytest tests/` — 44 passed (22 pre-existing + 22 new)
- `python3 scripts/audit_navigation.py --check` — exit 0, integrity
clean
- `mint broken-links` — no new broken links
- Both workflows parse; triggers and permissions confirmed

## Follow-ups, not in this PR

- `tutorials/working_with_controls.mdx:24` links to
`/getting_started/service-accounts`, which has never existed — the page
is `/administration/authentication/service_accounts`. Broken on `main`
since #154; `link-rot` reports `skipping`, which is why it went unseen.
- The `mintlify-docs` plugin in `kosli-plugins` still ships
near-duplicate `doc-writer`/`doc-reviewer` agents that say "update
`docs.json` navigation" — the pre-`config/` layout. Needs its own PR
there.
- The reviews twice asked for `python3` in `doc-review.yml`'s
`--allowedTools` to validate JSON payloads and fence balance. Left alone
— `Bash(python3:*)` is a security-surface call worth making
deliberately.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant