vania-janet/multiturn-rag-retrieval-data huggingface dataset:
hello-iac-sample_tf-backend-s3-bucket : bucket-to-store-tfstate-of-hello-iac-sample









 Release to inventory 

Use the release to inventory user script stage to add artifacts to the inventory by using the cocoa inventory add CLI command. For more information about cocoa inventory add, see [cocoa inventory add](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cliinventory-add).

You can use the pipelinectl interface to access your repos and artifacts by using the list_repos, load_repo, list_artifacts, and load_artifact commands. For more information, see [pipelinectl](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-pipelinectl).





 Collecting compliance data on build 

When the pipeline runs successfully, you can collect information about the build.

Evidence is collected on all checks, scans, tests, and artifact signings and is placed into the evidence locker. The pipeline log files are also saved to the locker, along with the pipeline data itself, containing the Tekton definitions. Compliance data on peer reviews is also collected in this step. The pipeline uses pipelinectl to search for repos with pull requests that were merged since the last build. The pipeline also checks PR review status, saves it as an artifact, and creates evidence based on the result.

The final script is an evaluator, which marks the pipeline status green or red, based on the evidence statuses. If there are any failures, the continuous integration run is marked as red.
--org Evidence Repositories owner organisation (can be substituted by EVIDENCE_REPO_ORG environment variable)
--pipeline-run-id (Required)
--toolchain-crn (Required)
--prefix-list (Required) a list of paths separated by comma where evidences can be found in the repository
--output (Optional) file name to write the evidence summary into
--git-token-path (Optional) Github Token's path
--git-api-url (Optional) Github API url

If you are using github, use --git-token-path field to set your GitHub Token and --git-api-url field to set the # GitHub Enterprise API URL instead of GHE_TOKEN and GH_URL environment variables. If both GHE_TOKENGH_URL and --git-token-path--git-api-url pairs are provided, then --git-token-path and --git-api-url take precedence.

By default, the CLI on each invocation ensures that you work with an up-to-date version of a Git locker. This behavior can be disabled by setting COCOA_USE_CACHE to any value except 0, false, no, or n. In this case, the CLI uses its internal cache to look up evidence (much faster), but results might be stale.

Required Environment Variables, if you are using Cloud Object Storage:

COS_API_KEY= COS api token
COS_BUCKET_NAME= COS bucket name where evidences are stored
COS_ENDPOINT= COS endpoint where the bucket is available
PIPELINE_RUN_ID= Can be used instead of '--pipeline-run-id' option
TOOLCHAIN_CRN= Can be used instead of '--toolchain-crn' option

Options for cos:

--backend (Required) Specifies the type of locker from where the evidences are queried
--pipeline-run-id (Required)
--toolchain-crn (Required)
If both GHE_TOKENGH_URL and --git-token-path--git-api-url pairs are provided, then --git-token-path and --git-api-url take precedence.

By default, the CLI on each invocation ensures that you work with an up-to-date version of a Git locker. This behavior can be disabled by setting COCOA_USE_CACHE to any value except 0, false, no, or n. In this case, the CLI uses its internal cache to look up evidence (much faster), but results might be stale.

Running the command:

 Uses the environment as target, and pretty-prints only a given property of the inventory entry to the console.
$ cocoa inventory get --org='Github-ID' --repo='compliance-inventory-repo' --entry='hello-compliance-app' --environment='master' --property='name'

 Uses the version as target, and pretty-prints the whole content of the inventory entry to the console.
$ cocoa inventory get --org='Github-ID' --repo='compliance-inventory-repo' --entry='hello-compliance-app' --version='v1'





 cocoa inventory get-sha 

Gets the latest commit hash by a label or environment from the inventory repository. Either use --label or --environment, and use only one of them.

Required Environment Variables, if you are using GitHub:

GHE_TOKEN= Github Enterprise API Token (Optional if you are using --git-token-path)

Options for Git:

--git-token-path (Optional) Github Token's path
--git-api-url (Optional) Github API url

If you are using github, use --git-token-path field to set your GitHub Token and --git-api-url field to set the # GitHub Enterprise API URL instead of GHE_TOKEN and GH_URL environment variables.
--git-token-path (Optional) Github Token's path
--git-api-url (Optional) Github API url

If you are using github, use --git-token-path field to set your GitHub Token and --git-api-url field to set the # GitHub Enterprise API URL instead of GHE_TOKEN and GH_URL environment variables. If GHE_TOKENGH_URL and --git-token-path--git-api-url pairs are provided, --git-token-path and --git-api-url take precedence.

Running the command:

 Get the latest commit hash of the staging branch
$ cocoa inventory get-sha --org='Github-ID' --repo='compliance-inventory-repo' --environment='staging'

 Get the commit hash of the "pipeline-run-id" label
$ cocoa inventory get-sha --org='Github-ID' --repo='compliance-inventory-repo' --label='pipeline-run-id'





 cocoa inventory label 

Adds a label to an inventory entry, or moves a label in the inventory. The target can be the latest commit on a specific branch or another label.

Options:

--org The Github organisation which owns the inventory repository.
--repo The name of the inventory repository.
--environment The inventory branch
--to-label Another label in the inventory, that will be looked up/removed

Required Environment Variables:

GHE_ORG= Github Organization (required if --org option is not specified).
GHE_REPO= Github Repository (required if --repo option is not specified).

Required Environment Variables, if you are using GitHub:

GHE_TOKEN= Github Enterprise API Token (Optional if you are using --git-token-path)

Options for Git:

--git-token-path (Optional) Github Token's path
-o --output-dir (Required) Specifies the directory where the logs will be saved
--pipeline-id ID of the pipeline
--pipeline-run-id ID of the pipeline run
-u --use-task-ref (Optional) Can be used to override the default name of the pipeline task to the taskRef, when creating the directory
--task-name (Optional) use task-name to fetch the logs for --task-name
--step-name (Optional) use step-name in conjunction with task-name to fetch the log for --step-name

Required Environment Variables:

IBMCLOUD_API_KEY= IBM Cloud API Token
TOOLCHAIN_REGION= Region of the toolchain
PIPELINE_ID= Can be used instead of '--pipeline-id option
PIPELINE_RUN_ID= Can be used instead of '--pipeline-run-id option

Running the command:

$ cocoa tekton get-pipeline-logs --output-dir=<output-dir> --pipeline-id=<pipeline-id> --pipeline-run-id=<pipeline-run-id> --use-task-ref







 cocoa changelog commands 



 cocoa changelog 

This command is deprecated and will be removed in 2.0.0.

cocoa changelog is not supported in Git Repos and Issue Tracking.

Prints the changelog between two revisions in the repo to stdout.

Options:

--org Defaults to GHE_ORG env variable, github organization
--repo Defaults to GHE_REPO env variable, name of the github repository

Required Environment Variables:

GHE_TOKEN= Github Enterprise API Token (Required)
GHE_ORG= The owner of the repository (optional, when --org is not provided)
GHE_REPO= The repository name (optional, when --repo is not provided)

This command contains three usage methods:



* Check commits in range when both --from and --to options are provided.



Options:

--from git commit hash to calculate the changes from
Answer: For NON-PROD, yes, using [API calls](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-supportadmin-util-api-calls).
11. Can customers use Manage (Maximo) MXLoader?

Answer: Technically, IBM does not support MXLoader, but customers can use MXLoader outside of the IBM hosted SRE environment and connect to their database via the MIF (Maximo Integration Framework).
12. Does MAS-Dedicated support email, is there one provided out of the box? Can customer configure their own SMTP server?

Answer: Yes, please refer to [SMTP Setup](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-supportsmtp-setup). If a customer wants to use their own SMTP server, they can open ticket with IBM and provide more details.
Reading to and from file:
$ cocoa evidence format-summary --input=raw-summary.json --output=formatted-summary.txt





 cocoa evidence markdown-summary 

Formats the evidence summary into a markdown format that can be fed as a GitHub pull request comment.

The input is a raw summary and can be in one of two formats:



* Summary in JSON format (output of the cocoa evidence summarize command).
* Aggregated summary, which is a JSON array of individual app summaries.



When an aggregated summary is passed as input, the output groups the evidence status based on the apps in the summaries.

Optional flag:



* --detailed: A detailed markdown summary is generated if the flag is set to true (true by default, set to false for a trimmed down summary).



Running the command:

$ cocoa evidence markdown-summary --input=<filepath> (default: -, referring to stdin) If present, the formatted evidence will be read from the given file.
--output=<filepath> (default: -, referring to stdout) If present, the formatted evidence will be saved to the given file.

 Reading from stdin and printing to stdout:
$ cat raw-summary.json | cocoa evidence markdown-summary -i - -o - | tee markdown-summary.md
$ cat aggr-summary.json | cocoa evidence markdown-summary | tee markdown-summary.md
 Reading to and from file:
$ cocoa evidence markdown-summary --input=raw-summary.json --output=markdown-summary.md





 cocoa evidence upload 

Uploads evidence to the specified backends. Backends can be different evidence locker types, for example Object Storage, GitHub or DevOps Insights. Different lockers require different parameters to be provided.

DevOps Insights is not yet supported.

Required Options:

--backend

Required Environment Variables:

EVIDENCE_REPO_ORG= Evidence repo org (Required if you are using 'git' backend)
$ cat data.txt | cocoa change-request task update --change-request-id='CHGXXXXXXX' --change-task-id='CTASKXXXXXXX' --data='@/dev/stdin'

$ cocoa change-request task update --change-request-id='CHGXXXXXXX' --change-task-id='CTASKXXXXXXX' --data='@<path/to/file>'





 cocoa change-request attachment add 

Adds a Change attachment to a specific Change Request.

Options:

--description A more detailed description for the Change Task. [string]
--name Name of the Change Task. [string] [required]
--data Data for the Change Task or a path prefixed with @ to read the data from. [string] [default: "@/dev/stdin"]
--provider (Optional) Change Management service provider (choices: 'servicenow', 'servicenow-v3', default: 'servicenow')

Required Environment Variables, if you are using ServiceNow v1 or v2 provider:

SERVICENOW_TOKEN= ServiceNow API Token
SERVICENOW_URL= ServiceNow API URL

Required Environment Variables, if you are using ServiceNow v3 provider:

IAM_ACCESS_TOKEN= Access token obtained from the IAM service corresponding to pnp-ibmcloud-api-key.
SERVICENOW_URL= ServiceNow API URL

Running the command:

$ cocoa change-request attachment add "CHGXXXXXXX" --name='<attachment-name>' --data='<data-for-the-attachment>'

$ cat data.txt | cocoa change-request attachment add "CHGXXXXXXX" --name='<attachment-name>'

$ cocoa change-request attachment add "CHGXXXXXXX" --name='<attachment-name>' --data='@<path/to/file>'





 cocoa change-request attachment get 

Gets a specific Change attachment of a Change Request.

Options:
metadata:
labels:
app: testpod
spec:
containers:
- image: IMAGE
name: CONTAINER-NAME
volumeMounts:
- mountPath: /myvol
name: pvc-name
volumes:
- name: pvc-name
persistentVolumeClaim:
claimName: pvc-static The name of the PVC that you created earlier
Show more

spec.containers.image
: The name of the container image that you want to use. To list available images in your IBM Cloud Container Registry account, run ibmcloud cr image-list.

spec.containers.name
: The name of the container that you want to deploy to your cluster.

spec.containers.volumeMounts.mountPath
: Enter the absolute path of the directory to where the volume is mounted inside the container. Data that is written to the mount path is stored under the root directory in your physical File Storage for VPC instance. If you want to share a volume between different apps, you can specify [volume sub paths](https://kubernetes.io/docs/concepts/storage/volumes/using-subpath) for each of your apps.

volumeMounts.name
: Enter the name of the volume to mount to your pod.

volume.name
: Enter the name of the volume to mount to your pod. Typically this name is the same as volumeMounts.name.

volumes.persistentVolumeClaim.claimName
: Enter the name of the PVC that binds the PV that you want to use.
$ cat data.txt | cocoa change-request attachment add "CHGXXXXXXX" --name='<attachment-name>'

$ cocoa change-request attachment add "CHGXXXXXXX" --name='<attachment-name>' --data='@<path/to/file>'





 cocoa change-request attachment get 

Gets a specific Change attachment of a Change Request.

Options:

--provider (Optional) Change Management service provider (choices: 'servicenow', 'servicenow-v3', default: 'servicenow')

Required Environment Variables, if you are using ServiceNow v1 or v2 provider:

SERVICENOW_TOKEN= ServiceNow API Token
SERVICENOW_URL= ServiceNow API URL

Required Environment Variables, if you are using ServiceNow v3 provider:

IAM_ACCESS_TOKEN= Access token obtained from the IAM service corresponding to pnp-ibmcloud-api-key.
SERVICENOW_URL= ServiceNow API URL

Running the command:

cocoa change-request attachment get "CHGXXXXXXX" "CTASKXXXXXXX"





 cocoa change-request attachment list 

Lists Change attachments for a Change Request.

Options:

--provider (Optional) Change Management service provider (choices: 'servicenow', 'servicenow-v3', default: 'servicenow')

Required Environment Variables, if you are using ServiceNow v1 or v2 provider:

SERVICENOW_TOKEN= ServiceNow API Token
SERVICENOW_URL= ServiceNow API URL

Required Environment Variables, if you are using ServiceNow v3 provider:

IAM_ACCESS_TOKEN= Access token obtained from the IAM service corresponding to pnp-ibmcloud-api-key.
SERVICENOW_URL= ServiceNow API URL

Running the command:

cocoa change-request attachment list "<insert-change-request-id-here>"





 cocoa change-request attachment update 

Updates a Change attachment in a specific Change Request.

Options:

--change-request-id The change request the change task belongs to [string] [required]
* Using the [DevSecOps CLI](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cli) to download your scan results from the evidence locker by using the information that is printed in the stage log. For more information, see the following resources:



* [cocoa locker evidence get](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-clilocker-evidence-get)
* [cocoa locker attachment get](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-clilocker-attachment-get)









 Related links 



* [Navigating to the web UI for IBM Cloud Security and Compliance Center Workload Protection](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-launch)
* [Sysdig Secure documentation](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-sysdig_doc)
PIPELINE_RUN_ID= Can be used instead of '--pipeline-run-id' option
TOOLCHAIN_CRN= Can be used instead of '--toolchain-crn' option

Options for cos:

--backend (Required) Specifies the type of locker from where the evidences are queried
--pipeline-run-id (Required)
--toolchain-crn (Required)
--prefix-list (Required) a list of paths separated by comma where evidences can be found in the repository
--output (Optional) file name to write the evidence summary into

Running the command:

 Save the evidence summary to 'summary.json' file.
$ cocoa evidence summarize --backend='git' --pipeline-run-id='id-123-123' --toolchain-crn='crn-123-123' --prefix-list='raw/ci/pipeline-run-id-1,raw/ci/pipeline-run-id-2' --output='summary.json'

 Print the evidence summary to the console
$ cocoa evidence summarize --backend='git' --pipeline-run-id='id-123-123' --toolchain-crn='crn-123-123' --prefix-list='raw/ci/pipeline-run-id-1,raw/ci/pipeline-run-id-2'







 cocoa artifact commands 



 cocoa artifact upload 

Uploads an artifact to the specified backends. Backends can be different evidence locker types, for example Object Storage, GitHub or DevOps Insights. Different lockers require different parameters to be provided.

Options:

--backend (Required) Specifies the types of lockers we upload the artifact ('cos', 'git')
--pipeline-run-id The ID of the PipelineRun running the CLI command
--namespace Specifies the pipeline the evidence is collected from
--upload-path If present, this overrides the artifact name with the specified value
DevSecOps CLI 

DevSecOps CLI adopts compliance solutions under IBM Cloud® DevSecOps reference implementation; for example, the shift-left reference pipelines. For more information about the shift-left compliance architecture, see [DevSecOps with Continuous Delivery](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops_intro).



 CLI interface 

The CLI uses a multipart structure on the command line that you must specify in the following order:

cocoa <command> <subcommand> [options]



1. The base call to the CLI.
2. The main command, which typically corresponds to a service or a module that is used by the shift-left architecture; for example, change request, inventory, or tekton.
3. The subcommand that specifies which action to perform.
4. CLI options required by the action. On condition that they follow steps 1-3, you can specify the CLI options in any order.



Some commands use environment variables to get API Keys or to configure an option value that was not provided in the command line. You need to export these variables before you run the command.

Command-line options can take various types of input values, such as numbers, strings, Boolean values, arrays, and JSON objects. The options type is dependent upon the command that you specify. Use cocoa <command> <subcommand> --help to see the options types.





 Retrying failed API calls 

The Cocoa CLI retries any API call that fails with a response status of 5xx three times. You can override this behavior by providing following environment variables:



* MAX_RETRY_ATTEMPTS - The number of retry attempts Cocoa CLI makes before it gives up. For example, MAX_RETRY_ATTEMPTS=5
* RETRY_STATUS_CODE - The response status codes for which the retry happens. For example, RETRY_STATUS_CODE=409,422,500 to retry on these three status codes.
Uploads evidence to the specified backends. Backends can be different evidence locker types, for example Object Storage, GitHub or DevOps Insights. Different lockers require different parameters to be provided.

DevOps Insights is not yet supported.

Required Options:

--backend

Required Environment Variables:

EVIDENCE_REPO_ORG= Evidence repo org (Required if you are using 'git' backend)
EVIDENCE_REPO_NAME= Evidence repo name (Required if you are using 'git' backend)

Required Environment Variables, if you are using GitHub:

GHE_TOKEN= Github Enterprise API Token (Optional if you are using --git-token-path)

Required Environment Variables, if you are using Cloud Object Storage:

COS_API_KEY= Cloud Object Storage API Key (Required if you are using 'cos' backend)
COS_BUCKET_NAME= Bucket Name where the evidence will be uploaded in the COS Instance (Required if you are using 'cos' backend)
COS_ENDPOINT= The COS API Endpoint matching the region where the bucket is located (Required if you are using 'cos' backend)

If you are using github, use --git-token-path field to set your GitHub Token and --git-api-url field to set the # GitHub Enterprise API URL instead of GHE_TOKEN and GH_URL environment variables. If both of them are provided, --git-token-path and --git-api-url take precedence.

Running the command:

$ cocoa evidence upload

$ cocoa evidence upload --backend=[choices: "git", "insights", "cos"] e.g. --backend=cos,git,insights
--namespace=[choices: "ci", "cd"] Pipeline type the evidence was collected from
--evidence-name=<evidence-name> It will be used to name evidence-file in git
--evidence-type=<evidence-type> e.g: com.ibm.unit_test
--org (Required) Owner of the evidence locker repo, defaults to EVIDENCE_LOCKER_REPO_OWNER
--repo (Required) Name of the evidence locker repo, defaults to EVIDENCE_LOCKER_REPO_NAME
--git-token-path Git token path to read the secret from
--git-api-url Git API URL
--evidences-path (Required) Use this path to read the evidences to be published
--commit-message (Optional) Commit message suffix to be used for the commit to the git repository

Run the command:

$ cocoa locker evidence publish  --org=<github-organization> --repo=<github-repo-name> --git-provider github --evidences-path <path/to/file>







 cocoa tekton commands 



 cocoa tekton get-pipeline-logs 

Creates log files for every step from a pipeline run and saves it to a directory. Use either the environment variables (PIPELINE_ID, PIPELINE_RUN_ID) or override the environment variables with explicit flags (--pipeline-id, --pipeline-run-id). Log files can be retrieved on a per-task and per-step level as well by supplying --task-name and --step-name flags.

If --task-name is provided, the command tries to pull and creates the log files for every step for the given task name.

If --step-name is provided along --task-name, the command creates the log file for the specific step for the provided task-name. --step-name without the --task-name is an invalid command signature.

Options:

-o --output-dir (Required) Specifies the directory where the logs will be saved
--pipeline-id ID of the pipeline
--pipeline-run-id ID of the pipeline run
-u --use-task-ref (Optional) Can be used to override the default name of the pipeline task to the taskRef, when creating the directory
--task-name (Optional) use task-name to fetch the logs for --task-name
Setting pull request status 

You can use the [DevSecOps CLI](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cli)set-status command to set a GitHub or GitLab commit status. For more information about this command, see the [DevSecOps CLI documentation](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cliset-status).



* Example usage on GitLab:



$ export GITLAB_TOKEN='my-git-token'
$ export GHE_ORG='my-github-username'
$ export GHE_REPO='my-github-repo-name'
$ export GIT_COMMIT='1df4adf81a294315a3fb4e211df9ae6cad4895c1'
$ cocoa set-status --state="pending" --targetURL="https://cloud.ibm.com/devops/pipelines/tekton/pipeline-id/runs/run-id/lint/lint?env_id=ibm:yp:us-south" --context="tekton/lint" --description="Tekton linter is running." --git-provider="gitlab"



* Example usage on GitHub:



$ export GHE_TOKEN='my-git-token'
$ export GHE_ORG='my-github-username'
$ export GHE_REPO='my-github-repo-name'
$ export GIT_COMMIT='1df4adf81a294315a3fb4e211df9ae6cad4895c1'