Skip to content

kosli_evaluate_trails.md

Latest commit

 

History

History
105 lines (86 loc) · 4.28 KB

kosli_evaluate_trails.md

File metadata and controls

105 lines (86 loc) · 4.28 KB
Raw
title kosli evaluate trails
tag BETA
description Evaluate multiple trails against a policy.

import CliBetaNotice from "/snippets/cli-beta-notice.mdx";

Synopsis

kosli evaluate trails TRAIL-NAME [TRAIL-NAME...] [flags]

Evaluate multiple trails against a policy. Fetch multiple trails from Kosli and evaluate them together against a Rego policy. The trail data is passed to the policy as input.trails (an array), unlike evaluate trail which passes input.trail (a single object).

Use --attestations to enrich the input with detailed attestation data (e.g. pull request approvers, scan results). Use --show-input to inspect the full data structure available to the policy. Use --output json for structured output.

Flags

Flag Type Description
--assert bool [optional] Exit with a non-zero status when the policy denies. This is the current default; pass --assert to lock it in across future releases.
--attestations strings [optional] Limit which attestations are included. Plain name for trail-level, dot-qualified (artifact.name) for artifact-level.
-f, --flow string The Kosli flow name.
-h, --help bool help for trails
--no-assert bool [optional] Print the result and always exit 0, even when the policy denies. Use when this command feeds another tool as a policy decision point.
-o, --output string [defaulted] The format of the output. Valid formats are: [table, json]. (default "table")
--params string [optional] Policy parameters as inline JSON or @file.json. Available in policies as data.params.
-p, --policy string Path or http(s):// URL of a Rego policy to evaluate against the trails.
--show-input bool [optional] Include the policy input data in the output.

Flags inherited from parent commands

Flag Type Description
-a, --api-token string The Kosli API token.
-c, --config-file string [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml")
--debug bool [optional] Print debug logs to stdout.
-H, --host string [defaulted] The Kosli endpoint. (default "https://app.kosli.com")
--http-proxy string [optional] The HTTP proxy URL including protocol and port number. e.g. http://proxy-server-ip:proxy-port
-r, --max-api-retries int [defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)
--org string The Kosli organization.
-q, --quiet bool [optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both --quiet and --debug are set, --debug wins.

Examples Use Cases

These examples all assume that the flags --api-token, --org, --host, (and --flow, --trail when required), are set/provided.

```shell kosli evaluate trails yourTrailName1 yourTrailName2 --policy yourPolicyFile.rego 
</Accordion>
<Accordion title="evaluate trails with attestation enrichment">
```shell
kosli evaluate trails yourTrailName1 yourTrailName2 
	--policy yourPolicyFile.rego 
	--attestations pull-request
```shell kosli evaluate trails yourTrailName1 yourTrailName2 --policy yourPolicyFile.rego --show-input --output json 
</Accordion>
<Accordion title="evaluate trails with policy parameters">
```shell
kosli evaluate trails yourTrailName1 yourTrailName2 
	--policy yourPolicyFile.rego 
	--params '{"min_approvers": 2}'
```shell kosli evaluate trails yourTrailName1 yourTrailName2 --policy https://policies.example.com/trails.rego 
</Accordion>
<Accordion title="evaluate trails as a decision point (print verdict, never fail the step)">
```shell
kosli evaluate trails yourTrailName1 yourTrailName2 
	--policy yourPolicyFile.rego 
	--no-assert