Repository: cli/cli
File: pkg/cmd/attestation/verify/verify.go (Go)

Code before:
			%[1]s--predicate-type%[1]s flag.

			The "actor identity" consists of:
			* the repository or the repository owner the artifact is linked with
			* the Actions workflow that produced the attestation (a.k.a the
			  signer workflow)

			This identity is then validated against the attestation's certificate's
			SourceRepository, SourceRepositoryOwner, and SubjectAlternativeName
			(SAN) fields, among others.

			It is up to you to decide how precisely you want to enforce this identity.

			At a minimum, this command requires either:
			* the %[1]s--owner%[1]s flag (e.g. --owner github), or
			* the %[1]s--repo%[1]s flag (e.g. --repo github/example)

			The more precisely you specify the identity, the more control you will
			have over the security guarantees offered by the verification process.

			Ideally, the path of the signer workflow is also validated using the
			%[1]s--signer-workflow%[1]s or %[1]s--cert-identity%[1]s flags.

			Please note: if your attestation was generated via a reusable workflow then
			that reusable workflow is the signer whose identity needs to be validated.
			In this situation, you must also use either the %[1]s--signer-workflow%[1]s or
			the %[1]s--signer-repo%[1]s flag.

			For more options, see the other available flags.

			## Loading Artifacts And Attestations

			To specify the artifact, this command requires:
			* a file path to an artifact, or
			* a container image URI (e.g. %[1]soci://<image-uri>%[1]s)
			  * (note that if you provide an OCI URL, you must already be authenticated with
			its container registry)

			By default, this command will attempt to fetch relevant attestations via the
			GitHub API using the values provided to %[1]s--owner%[1]s or  %[1]s--repo%[1]s.

			To instead fetch attestations from your artifact's OCI registry, use the
			%[1]s--bundle-from-oci%[1]s flag.

			For offline verification using attestations stored on disk (c.f. the download command)
			provide a path to the %[1]s--bundle%[1]s flag.

			## Additional Policy Enforcement

			Given the %[1]s--format=json%[1]s flag, upon successful verification this
			command will output a JSON array containing one entry per verified attestation.

Review comment (suggestion):
```suggestion
			In this situation, you must use either the %[1]s--signer-workflow%[1]s or
```

Code after:
			%[1]s--predicate-type%[1]s flag.

			The "actor identity" consists of:
			* the repository or the repository owner the artifact is linked with
			* the Actions workflow that produced the attestation (a.k.a the
			  signer workflow)

			This identity is then validated against the attestation's certificate's
			SourceRepository, SourceRepositoryOwner, and SubjectAlternativeName
			(SAN) fields, among others.

			It is up to you to decide how precisely you want to enforce this identity.

			At a minimum, this command requires either:
			* the %[1]s--owner%[1]s flag (e.g. --owner github), or
			* the %[1]s--repo%[1]s flag (e.g. --repo github/example)

			The more precisely you specify the identity, the more control you will
			have over the security guarantees offered by the verification process.

			Ideally, the path of the signer workflow is also validated using the
			%[1]s--signer-workflow%[1]s or %[1]s--cert-identity%[1]s flags.

			Please note: if your attestation was generated via a reusable workflow then
			that reusable workflow is the signer whose identity needs to be validated.
			In this situation, you must use either the %[1]s--signer-workflow%[1]s or
			the %[1]s--signer-repo%[1]s flag.

			For more options, see the other available flags.

			## Loading Artifacts And Attestations

			To specify the artifact, this command requires:
			* a file path to an artifact, or
			* a container image URI (e.g. %[1]soci://<image-uri>%[1]s)
			  * (note that if you provide an OCI URL, you must already be authenticated with
			its container registry)

			By default, this command will attempt to fetch relevant attestations via the
			GitHub API using the values provided to %[1]s--owner%[1]s or  %[1]s--repo%[1]s.

			To instead fetch attestations from your artifact's OCI registry, use the
			%[1]s--bundle-from-oci%[1]s flag.

			For offline verification using attestations stored on disk (c.f. the download command)
			provide a path to the %[1]s--bundle%[1]s flag.

			## Additional Policy Enforcement

			Given the %[1]s--format=json%[1]s flag, upon successful verification this
			command will output a JSON array containing one entry per verified attestation.