Improve commands

Author: SimonSchubert

assets/commands/gh-at.md

@@ -1,31 +1,102 @@
 # TAGLINE
 
-view mentions across GitHub issues, PRs, and comments
+Download and verify artifact attestations (alias for gh attestation)
 
 # TLDR
 
-**Show user mentions**
+**Verify an artifact** against a repository's attestations
 
-```gh at```
+```gh at verify [example.bin] --repo [owner/repo]```
 
-**Show with limit**
+**Verify an artifact** against an organization's attestations
 
-```gh at --limit [10]```
+```gh at verify [example.bin] --owner [org-name]```
+
+**Verify an OCI image**
+
+```gh at verify [oci://image-uri] --owner [org-name]```
+
+**Verify and print full JSON** result
+
+```gh at verify [example.bin] --owner [org-name] --format [json]```
+
+**Download attestations** for offline verification
+
+```gh at download [example.bin] --repo [owner/repo]```
+
+**Output the trusted root** for offline verification
+
+```gh at trusted-root --repo [owner/repo]```
 
 # SYNOPSIS
 
-**gh** **at** [_options_]
+**gh at** _command_ [_flags_]
 
 # PARAMETERS
 
-**-L**, **--limit** _num_
-> Maximum items.
+**verify** [_file-path_ | _oci://image-uri_]
+> Verify the integrity and provenance of an artifact using its associated attestations.
+
+**download** [_file-path_ | _oci://image-uri_]
+> Download an artifact's attestations for offline use.
+
+**trusted-root**
+> Output trusted_root.jsonl contents, for offline verification.
+
+**-o**, **--owner** _string_
+> GitHub organization to scope the attestation lookup by.
+
+**-R**, **--repo** _string_
+> Repository name in the format _owner/repo_.
+
+# VERIFY FLAGS
+
+**-d**, **--digest-alg** _string_
+> Digest algorithm used to compute the artifact's digest: sha256 or sha512 (default sha256).
+
+**--cert-identity** _string_
+> Enforce an exact match of the certificate's SubjectAlternativeName.
+
+**-i**, **--cert-identity-regex** _string_
+> Enforce a regex match of the certificate's SubjectAlternativeName.
+
+**--cert-oidc-issuer** _string_
+> Enforce the OIDC token issuer (default https://token.actions.githubusercontent.com).
+
+**--signer-repo** _string_
+> Enforce a match on the signer workflow's repository.
+
+**--signer-workflow** _string_
+> Enforce a match on the signer workflow's path.
+
+**-b**, **--bundle** _string_
+> Verify using a bundle stored on disk instead of fetching from GitHub.
+
+**--bundle-from-oci**
+> Fetch the attestation bundle from the OCI registry instead of GitHub.
+
+**--format** _string_
+> Output format; currently only **json** is supported.
+
+**-L**, **--limit** _int_
+> Maximum number of attestations to fetch (default 30).
 
 # DESCRIPTION
 
-**gh at** shows where you've been mentioned on GitHub. Displays issues, pull requests, and comments that mention your username.
+**gh at** is the built-in alias for **gh attestation**, part of the official **GitHub CLI**. It downloads and verifies build provenance attestations, cryptographically signed records that tie an artifact back to the GitHub repository, commit, and workflow that built it (via Sigstore). It's used to confirm that a downloaded binary, package, or container image genuinely came from the claimed source and build pipeline.
+
+# CAVEATS
+
+Requires either **--owner** or **--repo** to scope the lookup. Verification depends on network access to GitHub and Sigstore's public-good instance unless **--custom-trusted-root** or **--bundle** is used for fully offline verification.
 
 # SEE ALSO
 
-[gh-status](/man/gh-status)(1), [gh](/man/gh)(1)
+[gh](/man/gh)(1), [gh-release](/man/gh-release)(1)
+
+# RESOURCES
+
+```[Manual](https://cli.github.com/manual/gh_attestation)```
+
+```[Source code](https://github.com/cli/cli)```
 
+<!-- verified: 2026-07-17 -->

assets/commands/gh-rs.md

@@ -1,66 +1,96 @@
 # TAGLINE
 
-Bulk repository synchronization and cloning extension
+View GitHub repository rulesets (alias for gh ruleset)
 
 # TLDR
 
-**Sync all repos**
+**List rulesets** for the current repository
 
-```gh rs sync```
+```gh rs list```
 
-**Sync specific org**
+**List rulesets** for a different repository, including inherited ones
 
-```gh rs sync --org [orgname]```
+```gh rs list --repo [owner/repo] --parents```
 
-**Clone all repos**
+**List organization-wide** rulesets
 
-```gh rs clone --org [orgname]```
+```gh rs list --org [org-name]```
 
-**List repos to sync**
+**View a specific ruleset** by ID
 
-```gh rs list```
+```gh rs view [43]```
+
+**Open a ruleset** in the web browser
+
+```gh rs view [43] --web```
+
+**Check rules** that apply to the current branch
+
+```gh rs check```
+
+**Check rules** that apply to the default branch of another repository
+
+```gh rs check --default --repo [owner/repo]```
 
 # SYNOPSIS
 
-**gh rs** _command_ [_options_]
+**gh rs** _command_ [_flags_]
 
 # PARAMETERS
 
-**sync**
-> Synchronize repositories.
+**list**
+> List rulesets for a repository or organization.
 
-**clone**
-> Clone multiple repositories.
+**view** [_ruleset-id_]
+> View information about a ruleset. Prompts interactively if no ID is given.
 
-**list**
-> List repositories.
+**check** [_branch_]
+> View rules that would apply to a given branch. Uses the current branch if none is given.
 
-**--org** _ORGNAME_
-> Target organization.
+**-R**, **--repo** _[HOST/]OWNER/REPO_
+> Select another repository instead of the current one.
 
-**--user** _USERNAME_
-> Target user.
+# LIST FLAGS
 
-**--concurrency** _N_
-> Parallel operations.
+**-L**, **--limit** _int_
+> Maximum number of rulesets to list (default 30).
 
-**--help**
-> Display help information.
+**-o**, **--org** _string_
+> List organization-wide rulesets. Requires the **admin:org** token scope.
 
-# DESCRIPTION
+**-p**, **--parents**
+> Include rulesets configured at higher levels that also apply (default true).
 
-**gh rs** (repo-sync) is a GitHub CLI extension for bulk repository operations. It enables synchronizing and cloning multiple repositories from organizations or users in parallel.
+**-w**, **--web**
+> Open the list of rulesets in the web browser.
 
-The extension is useful for maintaining local copies of many repositories, setting up development environments, or backing up organization code. It handles authentication and rate limiting automatically.
+# VIEW/CHECK FLAGS
 
-# CAVEATS
+**-o**, **--org** _string_
+> Organization name, when the ID given to **view** is an organization-level ruleset.
+
+**--default**
+> With **check**, view rules on the repository's default branch.
+
+**-w**, **--web**
+> Open the ruleset or branch rules page in the web browser.
+
+# DESCRIPTION
 
-Extension must be installed via **gh extension install**. Bulk operations consume API rate limits. Large clones need sufficient disk space.
+**gh rs** is the built-in alias for **gh ruleset**, part of the official **GitHub CLI**. Rulesets let repository and organization admins enforce rules (required reviews, status checks, branch naming, force-push restrictions, etc.) on branches and tags. This command group is read-only: it lists and inspects rulesets and shows which rules apply to a given branch, but does not create or edit rulesets.
 
-# HISTORY
+# CAVEATS
 
-gh rs is a community **GitHub CLI extension** that adds bulk repository management capabilities beyond the built-in repo commands.
+Read-only: rulesets themselves are created and edited on GitHub.com or via the API, not through **gh ruleset**. Listing organization-wide rulesets with **--org** requires a token with the **admin:org** scope, obtainable via **gh auth refresh -s admin:org**.
 
 # SEE ALSO
 
-[gh](/man/gh)(1), [gh-repo](/man/gh-repo)(1), [gh-extension](/man/gh-extension)(1)
+[gh](/man/gh)(1), [gh-repo](/man/gh-repo)(1)
+
+# RESOURCES
+
+```[Manual](https://cli.github.com/manual/gh_ruleset)```
+
+```[Source code](https://github.com/cli/cli)```
+
+<!-- verified: 2026-07-17 -->

assets/commands/git-unpack-file.md

@@ -14,8 +14,20 @@ Extract blob contents to a temporary file
 
 # DESCRIPTION
 
-**git unpack-file** creates a temporary file with a blob's contents and prints the filename. It is a low-level plumbing command for accessing blob contents outside of the working tree.
+**git unpack-file** creates a temporary file with a blob's contents and prints the filename. It is a low-level plumbing command for accessing blob contents outside of the working tree, used internally during merges and by scripts that need direct access to a blob's data.
+
+# CAVEATS
+
+Creates a file named **.merge_file_XXXXXX** in the current directory. Git does not remove it automatically; the caller is responsible for deleting it once done.
 
 # SEE ALSO
 
 [git-cat-file](/man/git-cat-file)(1), [git-hash-object](/man/git-hash-object)(1)
+
+# RESOURCES
+
+```[Documentation](https://git-scm.com/docs/git-unpack-file)```
+
+```[Source code](https://github.com/git/git)```
+
+<!-- verified: 2026-07-17 -->

assets/commands/git-update-index.md

@@ -28,6 +28,10 @@ Modify index entries for tracked files
 
 ```git update-index --remove [file]```
 
+**Read paths to update from stdin**
+
+```find . -name "*.txt" | git update-index --add --stdin```
+
 # SYNOPSIS
 
 **git** **update-index** [_options_] [_files_...]
@@ -53,10 +57,37 @@ Modify index entries for tracked files
 > Remove file from index.
 
 **--refresh**
-> Refresh stat info.
+> Refresh stat info; errors on paths that need updating unless **-q** is given.
+
+**-q**
+> Used with **--refresh**: continue quietly even if paths need updating, instead of erroring out.
+
+**--really-refresh**
+> Like **--refresh**, but check stat information unconditionally, ignoring the assume-unchanged bit.
+
+**--chmod=(+|-)x**
+> Set or unset the executable bit for updated paths.
+
+**--stdin**
+> Read list of paths from standard input instead of the command line, one per line (or NUL-separated with **-z**).
+
+**--index-info**
+> Read index entries (mode, object, path) from standard input to add, replace, or remove entries directly.
+
+**--cacheinfo** _mode_,_object_,_path_
+> Directly insert an entry into the index without needing a corresponding file in the working tree.
 
-**--chmod** _mode_
-> Set executable bit.
+**-z**
+> Use NUL as the line terminator with **--stdin** or **--index-info**.
+
+**--ignore-submodules**
+> Skip submodule checks when used with **--refresh**.
+
+**--split-index**, **--no-split-index**
+> Enable or disable the split-index feature for large repositories.
+
+**--untracked-cache**, **--no-untracked-cache**
+> Enable or disable caching of untracked file information to speed up **git status**.
 
 # DESCRIPTION
 
@@ -66,4 +97,12 @@ The most common use is the `--assume-unchanged` flag, which tells Git to tempora
 
 # SEE ALSO
 
-[git-add](/man/git-add)(1), [git-rm](/man/git-rm)(1)
+[git-add](/man/git-add)(1), [git-rm](/man/git-rm)(1), [git-ls-files](/man/git-ls-files)(1)
+
+# RESOURCES
+
+```[Documentation](https://git-scm.com/docs/git-update-index)```
+
+```[Source code](https://github.com/git/git)```
+
+<!-- verified: 2026-07-17 -->

assets/commands/git-update-ref.md

@@ -39,14 +39,28 @@ Safely update Git reference values
 > Reflog message.
 
 **--stdin**
-> Read from stdin.
+> Read update instructions (update, create, delete, verify, symref-update, etc.) from standard input, applying them together as one atomic transaction.
+
+**-z**
+> Use NUL-terminated arguments with **--stdin** instead of quoted, whitespace-terminated strings.
+
+**--batch-updates**
+> With **--stdin**, allow individual updates in the transaction to fail without aborting the others.
 
 # DESCRIPTION
 
 **git update-ref** safely updates ref names stored in the repository. It provides atomic ref updates with optional old value verification, ensuring that a ref is only changed if it currently points to an expected value.
 
-This is a low-level plumbing command used internally by higher-level commands like `git branch` and `git tag`.
+This is a low-level plumbing command used internally by higher-level commands like `git branch` and `git tag`. With **--stdin**, multiple ref updates can be batched into a single atomic transaction.
 
 # SEE ALSO
 
-[git-symbolic-ref](/man/git-symbolic-ref)(1), [git-branch](/man/git-branch)(1)
+[git-symbolic-ref](/man/git-symbolic-ref)(1), [git-branch](/man/git-branch)(1), [git-tag](/man/git-tag)(1)
+
+# RESOURCES
+
+```[Documentation](https://git-scm.com/docs/git-update-ref)```
+
+```[Source code](https://github.com/git/git)```
+
+<!-- verified: 2026-07-17 -->

assets/commands/git-var.md

@@ -20,6 +20,10 @@ Display Git logical variables
 
 ```git var GIT_COMMITTER_IDENT```
 
+**Show configured pager**
+
+```git var GIT_PAGER```
+
 # SYNOPSIS
 
 **git** **var** [_variable_]
@@ -31,10 +35,20 @@ Display Git logical variables
 
 # DESCRIPTION
 
-**git var** shows Git logical variables such as the configured editor, author identity, and committer identity. These values are determined from environment variables and Git configuration.
+**git var** shows Git logical variables such as the configured editor, pager, and author/committer identity. These values are resolved from environment variables and Git configuration, following Git's own lookup order (e.g. `$GIT_EDITOR` falls back to `core.editor`, then `$VISUAL`, then `$EDITOR`).
+
+Other recognized variables include `GIT_SEQUENCE_EDITOR` (editor for `git rebase -i`), `GIT_DEFAULT_BRANCH`, `GIT_SHELL_PATH`, `GIT_ATTR_SYSTEM`/`GIT_ATTR_GLOBAL`, and `GIT_CONFIG_SYSTEM`/`GIT_CONFIG_GLOBAL`.
 
 The command is useful in scripts that need to query Git's resolved settings without parsing config files directly.
 
 # SEE ALSO
 
-[git-config](/man/git-config)(1)
+[git-config](/man/git-config)(1), [git-commit](/man/git-commit)(1)
+
+# RESOURCES
+
+```[Documentation](https://git-scm.com/docs/git-var)```
+
+```[Source code](https://github.com/git/git)```
+
+<!-- verified: 2026-07-17 -->