Updates
- Removed deprecated
kosli expect deploymentcommand — deployment expectation is no longer required for compliance. If your pipelines still reference this command, remove or replace it. - CI-ready Docker image — a new Alpine-based Dockerfile is available for use as a CI runner image (e.g., GitLab CI), providing the Kosli CLI alongside common CI tooling.
Bug fixes
- Fixed
kosli get attestation-typedisplayingtype_schemaas a Go map instead of formatted JSON. - The
--debugflag now shows the HTML response body when a server error occurs, improving troubleshooting.
Bug fixes
- Fixed
type_schemahandling — the provider now correctly reads JSON objects returned by the API, replacing the previous Python repr string workaround.
New features
- Deployment frequency statistics — the repository releases page now shows a deployment frequency bar chart with daily counts, a median line, and summary statistics for each environment.
Updates
- Removed the deprecated deployments API. This aligns with the CLI removal of
kosli expect deployment.
New features
kosli_actionresource and data source — manage webhook notification actions as Terraform resources. Create, update, and import actions by name, and read existing actions to reference in your configurations.kosli_policyresource and data source — manage Kosli policies as Infrastructure-as-Code. The data source exposes the policy name, description, content, and latest version.kosli_policy_attachmentresource — manage the relationship between policies and environments, letting you attach and detach policies declaratively.
New features
- Repository metadata on attestations — all
kosli attestcommands andkosli begin trailnow accept--repo-id,--repository,--repo-url, and--repo-providerflags to associate attestations and trails with their source repository. These flags are automatically populated from CI environment variables in GitHub Actions, GitLab CI, Bitbucket Pipelines, Azure DevOps, and CircleCI — no manual configuration needed. See the CI defaults reference. - Helm chart CronJob configuration — the k8s-reporter Helm chart now lets you configure
concurrencyPolicy,failedJobsHistoryLimit, andsuccessfulJobsHistoryLimitfor the reporter CronJob.
Updates
--repo-urlis now validated as a well-formed URL when explicitly provided.--repo-provideris validated against the allowed values:github,gitlab,bitbucket,azure-devops.- For
kosli attest pullrequest githubandkosli attest pullrequest azure, the--repositoryflag now also controls which repository is queried for pull requests.
Bug fixes
- Fixed an issue where artifact names with leading periods were rejected. Leading periods are now trimmed automatically.
New features
- Attestation evidence download — a new API endpoint lets you download evidence files attached to attestations, making it easier to retrieve and audit attestation data programmatically.
- Snapshotter role — a new Snapshotter role is available for users who need to create environment snapshots and manage service accounts without full member permissions. Ideal for environment and operations teams.
Bug fixes
- Fixed
kosli attest artifactsending empty repository information when no repo data is available.
New features
kosli evaluate trailandkosli evaluate trails— evaluate one or more trails against a Rego policy and get a structured pass/fail decision. Use--attestationsto filter which attestations are checked, and--output jsonfor machine-readable results. Exit code reflects the policy decision, making it ideal for CI/CD gates. See the evaluate trail and evaluate trails reference for details.- Multi-environment K8s reporting —
kosli snapshot k8snow accepts a--config-fileflag to report multiple Kosli environments in a single command. Define environment-to-namespace mappings in a YAML file instead of running the command once per environment. See the snapshot k8s reference. - Helm chart v2.0.0 — the k8s-reporter Helm chart now uses a
reporterConfig.environmentslist, enabling multi-environment reporting from a single chart installation. This is a breaking change from v1.x — see the chart README for migration steps.
Bug fixes
- Fixed handling of Python boolean (
true/false) and null values in custom attestation type schemas.
New features
kosli_logical_environmentresource — create and manage logical environments that aggregate multiple physical environments into a single view.kosli_logical_environmentdata source — query details of existing logical environments.- Drift detection for logical environments — Kosli now detects when the
included_environmentsof a logical environment change outside of Terraform. - User agent header — the provider now sends a versioned user agent on every API request, improving diagnostics.
Bug fixes
- Fixed a missing
flowfield in pull request attestation resources. - Fixed
terraform planshowing(known after apply)for thetypeattribute of logical environments instead of"logical".
New features
kosli_environmentresource — create and manage physical Kosli environments (K8S, ECS, S3, docker, server, lambda) as Terraform resources.kosli_environmentdata source — query details of existing physical environments.
Changes
schemaandjq_rulesare now optional fields onkosli_attestation_type, allowing you to create attestation types without a validation schema.