Every git, docker, kubectl, npm, and CI command - what it does and the errors it throws.

bb (Bitbucket)bb is a Bitbucket CLI for pull requests and pipelines. Reference for bb auth login, bb pr create, app-passwor… gh attestation verifygh attestation verify checks an artifact build provenance attestation against a repo or owner. Reference for… gh cache deletegh cache delete removes a GitHub Actions cache by key or ID, or all of them. Reference for --all, --succeed-o… gh cache listgh cache list shows GitHub Actions caches with their keys, sizes, and refs. Reference for --key, --ref, --sor… gh config setgh config set changes gh CLI settings like git_protocol, pager, and prompt. Reference for --host, the prompt-… gh extension installgh extension install adds a third-party or local gh extension. Reference for --pin, gh ext list, the already-… gh label creategh label create adds a label with a color and description, idempotently with --force. Reference for --color,… gh pr checksgh pr checks shows the status of CI checks on a pull request and can block until they finish. Reference for -… gh pr closegh pr close closes a pull request and can delete its branch or add a comment. Reference for --delete-branch,… gh pr diffgh pr diff prints the diff of a pull request, optionally name-only or in patch format. Reference for --name-o… gh pr editgh pr edit updates a pull request title, body, labels, reviewers, milestone, or base branch. Reference for --… gh pr readygh pr ready toggles a pull request between draft and ready-for-review. Reference for --undo, the bot-PR cavea… gh pr reviewgh pr review approves, requests changes, or comments on a pull request from CI. Reference for --approve, --re… gh pr statusgh pr status summarizes the PRs you created, are assigned, or are requested to review. Reference for --json,… gh release deletegh release delete removes a release and optionally its git tag. Reference for --yes, --cleanup-tag, and the i… gh release downloadgh release download pulls assets or source tarballs from a GitHub release. Reference for --pattern, --dir, --… gh release listgh release list shows releases with their tags, types, and dates. Reference for --limit, --exclude-drafts, --… gh release viewgh release view shows a release notes, assets, and metadata. Reference for the latest-release default, --json… gh repo forkgh repo fork creates a fork and can clone it and set the remotes. Reference for --clone, --remote, --fork-nam… gh repo set-defaultgh repo set-default chooses which repository gh targets when remotes are ambiguous. Reference for --view, the… gh rulesetgh ruleset lists, views, and checks the rulesets that apply to a branch. Reference for list, view, check, --j… gh run cancelgh run cancel stops an in-progress workflow run. Reference for targeting a run by ID, the already-completed c… gh run downloadgh run download retrieves artifacts uploaded by a workflow run. Reference for --name, --dir, --pattern, and t… gh run rerungh run rerun retries a workflow run, optionally only the failed jobs or with debug logging. Reference for --f… gh run watch --exit-statusgh run watch --exit-status blocks until a workflow run finishes and exits non-zero if it failed. Reference fo… gh search codegh search code finds code across repositories with qualifiers. Reference for --language, --repo, --json, and… gh search prsgh search prs finds pull requests across repos by author, label, state, and more. Reference for --state, --la… gh workflow enable/disablegh workflow enable and gh workflow disable toggle whether a workflow runs. Reference for selecting by name or… gh workflow viewgh workflow view shows a workflow definition, state, and recent runs. Reference for --yaml, --ref, --json, an… gh-dashgh-dash is a gh extension showing a PR/issue dashboard. Reference for gh dash, its config file, and why it is… ghorg cloneghorg clone bulk-clones every repo in a GitHub/GitLab org. Reference for --token, --scm-type, --clone-type, -… git absorbgit absorb creates fixup commits and squashes staged changes into the right ancestor. Reference for --and-reb… git addgit add stages changes for the next commit. Reference for -A, -p, --update, and the pathspec and ignored-file… git amgit am applies a mailbox of patches as commits, the receiving end of format-patch. Reference for --3way, --co… git apply --3waygit apply applies a patch to the working tree; --check tests it first and --3way falls back to a merge on con… git applygit apply applies a patch to the working tree or index. Reference for --check, --3way, and --index used to ap… git applygit apply applies a patch file to the working tree or index. Reference for --check, --3way, --index, -p, and… git archivegit archive exports a tree as a tar or zip. Reference for --format, --prefix, and pathspecs to build clean so… git archivegit archive exports a tree as a tar or zip without the .git directory. Reference for --format, --prefix, --ou… git bisect skip/termsgit bisect skip and custom good/bad terms let you binary-search a regression in CI even when some commits can… git bisect rungit bisect run automates a bisect with a test script’s exit code. Reference for the good/bad/skip exit codes… git bisectgit bisect binary-searches history to find the commit that introduced a bug. Reference for start, good, bad,… git blame --porcelaingit blame --porcelain gives stable machine-readable output, -L scopes to line ranges, and -C/-M follow moved… git blamegit blame shows which commit last changed each line. Reference for -L, --porcelain, and -w to attribute lines… git blamegit blame shows which commit and author last changed each line of a file. Reference for -L, -C, --since, and… git branch --set-upstream-togit branch --set-upstream-to links a local branch to a remote-tracking ref. Reference for -u, --unset-upstrea… git branch -d / -Dgit branch -d deletes a merged branch; -D force-deletes any branch. Reference for the not-fully-merged error,… git branchgit branch lists, creates, renames, and deletes branches. Reference for -d, -D, -m, --set-upstream-to, and th… git branchlessgit branchless (git-branchless) manages stacks with smartlog and submit. Reference for git submit, git sync,… git bundlegit bundle packs refs and objects into one file for offline transport. Reference for create, verify, clone, a… git cat-filegit cat-file inspects Git objects - their type, size, and content. Reference for -t, -s, -p, --batch, and the… git checkoutgit checkout switches branches or restores files. Reference for checking out a branch, --detach, and -b to cr… git checkoutgit checkout switches branches and restores files. Reference for -b, --detach, and pathspecs, plus the detach… git cherry-pick -x/-mgit cherry-pick -x records the source commit, and -m picks a side of a merge commit. Reference for backportin… git cherry-pickgit cherry-pick applies the changes of specific commits onto the current branch. Reference for -x, --no-commi… git cherry-pickgit cherry-pick applies the changes from specific commits onto the current branch. Reference for -x, -n, rang… git cherrygit cherry shows which commits on a branch have or have not been applied upstream. Reference for -v, the + /… git clean -fdx/-fdXgit clean removes untracked files; -x clears ignored files too while -X removes only ignored ones. Reference… git clean -fdxgit clean -fdx wipes untracked and ignored files plus directories for a pristine tree. Reference for -n, -e,… git cleangit clean deletes untracked files. Reference for -f, -d, and -x (git clean -fdx) to fully reset a working tre… git cleangit clean removes untracked files from the working tree. Reference for -n, -f, -d, -x, and the "would clobber… git --shallow-sincegit clone/fetch --shallow-since limits history to commits after a date, an alternative to --depth for CI. Ref… git clonegit clone copies a remote repository into a new directory. Reference for --depth, --branch, --filter, and --r… git clonegit clone copies a remote repository into a new local directory. Reference for depth, branch, and submodule f… git commitgit commit records staged changes as a new commit. Reference for -m, --amend, --no-verify, and the empty-comm… git config --globalgit config --global sets user-wide Git settings in ~/.gitconfig. Reference for identity, safe.directory, and… git config --localgit config --local writes settings into a single repo’s .git/config. Reference for per-repo identity, scope p… git configgit config reads and writes Git settings. Reference for user.email, --global, and credential.helper to set up… git configgit config gets and sets Git configuration at system, global, and local scope. Reference for --global, --get,… git count-objectsgit count-objects reports how many loose objects and packs a repo holds and their disk size. Reference for -v… git describe --tagsgit describe --tags --dirty builds a human version string from the nearest tag, the standard way CI stamps bu… git describegit describe builds a human-readable version from tags. Reference for --tags and --always to derive build ver… git describegit describe produces a readable name from the nearest tag, ideal for build versions. Reference for --tags, -… git diff --name-onlygit diff --name-only lists changed paths, --name-status adds the change type, and --diff-filter selects by ty… git diffgit diff shows changes between commits or the working tree. Reference for --name-only, --stat, and --exit-cod… git diff-treegit diff-tree is the plumbing command that compares two tree objects. Reference for -r, --name-only, --no-com… git diffgit diff shows changes between commits, the index, and the working tree. Reference for --staged, --name-only,… git fetch --deepengit fetch --deepen adds more commits to a shallow clone and --unshallow makes it complete. Reference for fixi… git fetchgit fetch downloads objects and refs from a remote without merging. Reference for --depth, --unshallow, --tag… git fetchgit fetch downloads remote objects and refs without touching your working tree. Reference for --depth, --unsh… git filter-repogit filter-repo rewrites repository history fast to strip files, paths, or secrets. Reference for --path, --i… git for-each-refgit for-each-ref lists refs with custom formatting. Reference for --sort, --format, and --count to script ove… git for-each-refgit for-each-ref iterates over refs with a custom format. Reference for --format, --sort, --points-at, and bu… git format-patch --cover-lettergit format-patch --cover-letter adds a 0000 summary patch to a series. Reference for -o, --subject-prefix, an… git format-patchgit format-patch turns commits into one .patch file per commit (or a range), the input for git am. Reference… git format-patchgit format-patch turns commits into mailbox patch files for review or git am. Reference for -N, --stdout, --c… git fsck --unreachablegit fsck checks object integrity and lists dangling/unreachable commits you can recover. Reference for --unre… git fsckgit fsck verifies object-database integrity and finds dangling or corrupt objects. Reference for --full, --lo… git gc --prune=nowgit gc compacts the object store and prunes unreachable objects; --prune=now removes them immediately. Refere… git gcgit gc compresses and cleans up a repository. Reference for --prune, --aggressive, and --auto to keep cached… git gcgit gc compresses and prunes the object database to keep the repo fast and small. Reference for --aggressive,… git grepgit grep searches tracked file contents fast, respecting the index and revisions. Reference for -n, -l, -i, -… git hash-objectgit hash-object computes the Git object id for content and can write it to the store. Reference for -w, --std… git initgit init creates a new empty Git repository or reinitializes an existing one. Reference for --bare, --initial… git interpret-trailersgit interpret-trailers adds or parses trailers like Signed-off-by in commit messages. Reference for --trailer… filter=lfs rule not taking effectFix files not going through LFS because the .gitattributes filter=lfs rule is not applied in CI - the attribu… "Authentication required: ... info/lfs"Fix Git LFS "Authentication required" in CI - the LFS batch endpoint got no usable credentials, so the object… "batch request: missing protocol"Fix Git LFS "batch request: missing protocol: ..." in CI - the configured LFS endpoint URL has no scheme (htt… "batch response: ... 403"Fix Git LFS "batch response: Forbidden" / 403 in CI - the LFS batch API authenticated the request but the tok… "Error downloading object ... (missing)"Fix Git LFS "Error downloading object: ... (missing)" in CI - the pointer references an object the LFS server… "should have been pointers, but weren't"Fix Git LFS "Encountered N file(s) that should have been pointers, but weren't" in CI - files matching an LFS… "413 Request Entity Too Large"Fix Git LFS push failing with HTTP 413 in CI - the LFS object upload exceeded a size limit imposed by the ser… "git-lfs filter-process: command not found"Fix "git: 'lfs' is not a git command" / "git-lfs: command not found" in CI - the git-lfs binary is not instal… "Fatal error: Server error"Fix Git LFS "LFS: Fatal error: Server error" in CI - the LFS object store returned a 5xx while streaming an o… "Locking support detected on remote"Fix Git LFS lfs.locksverify prompts and "locking not supported" during push in CI - the push wants a decision… "Object does not exist on the server"Fix Git LFS "Object does not exist on the server or you don't have permissions" in CI - the batch API cannot… "smudge filter lfs failed"Fix "external filter git-lfs smudge failed" / "smudge filter lfs failed" in CI - LFS could not download an ob… "over its data quota"Fix Git LFS "This repository is over its data quota" / bandwidth quota errors in CI - the account exceeded it… "locking not supported"Fix Git LFS "unable to lock" / "locking not supported" in CI - a lock command or lock verification ran agains… LFS clean filter stallingFix slow Git LFS clean-filter behavior in CI - committing or checking out many large files runs the clean/smu… git lfsgit lfs manages large files stored outside Git. Reference for git lfs install and git lfs pull to fetch large… LFS filters not registeredFix Git LFS pointers left in the tree because "git lfs install" was never run in CI - without it, the clean/s… "git lfs migrate import" pitfallsFix common git lfs migrate import problems in CI - rewriting history to move large files into LFS can fail on… LFS re-fetched on every jobFix Git LFS objects being re-downloaded on every CI run - without caching .git/lfs, each job re-fetches the s… Pointer text in place of the fileFix the case where CI has the LFS pointer text (version https://git-lfs...) instead of the real file - the ch… Old git-lfs on self-hosted runnerFix Git LFS failures caused by an old git-lfs version on a self-hosted runner in CI - stale binaries miss fea… git lfsgit lfs (Large File Storage) stores big files outside the repo via pointers. Reference for install, track, pu… git log --pretty=formatgit log --pretty=format:"..." emits exactly the fields a pipeline needs (SHA, author, subject), with -z for s… git loggit log shows commit history. Reference for --oneline, -n, and --format to extract commit messages and author… git loggit log shows commit history with flexible formatting. Reference for --oneline, --graph, --pretty, ranges, an… git ls-filesgit ls-files lists files in the index. Reference for listing tracked, ignored, or modified files to drive lin… git ls-filesgit ls-files lists files Git knows about in the index. Reference for --others, --modified, --exclude-standard… git ls-remotegit ls-remote lists refs on a remote without cloning, so CI can check a branch or tag exists first. Reference… git ls-remotegit ls-remote lists refs on a remote without cloning. Reference for --tags, --heads, and resolving a branch S… git ls-remotegit ls-remote lists refs on a remote without cloning. Reference for --heads, --tags, --exit-code, and the aut… git ls-treegit ls-tree lists the contents of a tree object - files, modes, and ids. Reference for -r, --name-only, -l, a… git machetegit machete tracks a tree of branches and rebases them with traverse. Reference for machete status, traverse… .mailmapA .mailmap file canonicalizes author names and emails across log, shortlog, and blame. Reference for the form… git maintenancegit maintenance runs and schedules repository upkeep tasks like gc, commit-graph, and prefetch. Reference for… git merge-basegit merge-base finds the common ancestor of two branches; --fork-point and --is-ancestor power PR diffs and g… git merge-basegit merge-base finds the best common ancestor of two commits. Reference for computing the PR base SHA that dr… git merge-basegit merge-base finds the common ancestor of two commits, the basis for diffing a PR. Reference for --fork-poi… git mergegit merge joins two branch histories into one. Reference for --no-ff, --squash, --abort, and how to detect an… git mvgit mv moves or renames a tracked file and stages the change. Reference for -f, -k, and the "destination exis… git notesgit notes attaches metadata to commits without changing their SHA. Reference for add, show, append, push/fetc… git pack-objectsgit pack-objects bundles objects into a compressed packfile. Reference for --stdout, --revs, --all, and the m… git prunegit prune deletes unreachable objects from the object store. Reference for -n, --expire, and why gc is usuall… git pullgit pull fetches from a remote and integrates the changes. Reference for --rebase, --ff-only, and the merge-c… "exceeds GitHub's file size limit of 100.00 MB"Fix "this exceeds GitHub's file size limit of 100.00 MB" in CI - a large file was committed as normal git con… git pushgit push uploads commits and tags to a remote. Reference for --tags, --follow-tags, and --force-with-lease as… git pushgit push uploads local commits to a remote. Reference for -u, --force-with-lease, and tags, plus the rejected… git range-diffgit range-diff compares two versions of a commit series to show what changed between iterations. Reference fo… git rebase --autosquashgit rebase -i --autosquash automatically reorders fixup! and squash! commits. Reference for --autosquash, com… git rebase --ontogit rebase --onto <newbase> <upstream> <branch> moves a slice of commits onto a new base, the precise tool fo… git rebasegit rebase replays commits onto a new base to keep history linear. Reference for -i, --onto, --continue, --ab… git reflog expiregit reflog records where HEAD has been so you can recover "lost" commits, and reflog expire prunes it. Refere… git refloggit reflog records where HEAD and branches have been, so you can recover lost commits. Reference for show, ex… git remote addgit remote add registers a new named remote URL. Reference for -f, -t, --tags, and the "remote already exists… git remotegit remote manages the set of tracked repositories. Reference for -v and set-url, used in CI to inspect or re… git remote prunegit remote prune deletes local remote-tracking refs whose upstream branches are gone. Reference for --dry-run… git remote set-urlgit remote set-url changes a remote’s URL, often to inject a CI token. Reference for --push, --add, and the n… git remotegit remote manages the named connections to remote repositories. Reference for add, set-url, -v, remove, and… git repackgit repack combines loose objects and packs into fewer, tighter packfiles. Reference for -a, -d, -A, and the… git replacegit replace substitutes one object for another without rewriting history. Reference for --edit, -d, --graft,… git request-pullgit request-pull generates a summary asking a maintainer to pull your changes. Reference for the start/url/en… git rereregit rerere records and replays conflict resolutions so repeated merges resolve automatically. Reference for e… git reset modesgit reset --soft, --mixed, and --hard differ in whether they touch the index and working tree. Reference for… git resetgit reset moves HEAD and optionally the index and working tree. Reference for --hard and --soft to roll back… git resetgit reset moves HEAD and optionally the index and working tree. Reference for --soft, --mixed, --hard, and ho… git restore --sourcegit restore --source pulls file contents from a specific commit into the working tree. Reference for -s, comb… git restore --stagedgit restore --staged unstages files without touching the working tree, the modern replacement for git reset H… git restoregit restore discards working-tree changes or unstages files. Reference for --staged, --source, --worktree, an… git rev-list --countgit rev-list --count counts commits in a range and --left-right --count compares two branches (ahead/behind).… git rev-list --countgit rev-list --count returns the number of commits in a range. Reference for --left-right, ranges, and using… git rev-listgit rev-list lists commit objects in reverse chronological order. Reference for --count to derive monotonic b… git rev-listgit rev-list lists commit objects in reverse order, the plumbing behind counting and walking history. Referen… git rev-parse --show-*git rev-parse resolves repo paths, refs, and state flags that CI scripts depend on: --show-toplevel, --abbrev… git rev-parsegit rev-parse resolves refs to SHAs and prints repo metadata. Reference for HEAD, --short, and --abbrev-ref t… git rev-parsegit rev-parse resolves refs to SHAs and reports repo paths - core CI plumbing. Reference for --short, --abbre… git revert -n/-mgit revert creates a new commit that undoes a previous one without rewriting history. Reference for -n (no-co… git revertgit revert undoes a commit by creating a new inverse commit, keeping history intact. Reference for -m, --no-c… git rmgit rm removes files from the working tree and the index. Reference for --cached, -r, -f, and the "has staged… git send-emailgit send-email mails patch files to reviewers over SMTP. Reference for --to, --cc, --smtp-server, and the aut… git shortloggit shortlog groups commits by author. Reference for -s, -n, and ranges to build contributor summaries and re… git shortlog (release notes)Using git shortlog to generate release notes and contributor summaries in CI. Reference for grouping, ranges,… git shortloggit shortlog summarizes commits grouped by author, perfect for changelogs and release notes. Reference for -s… git showgit show displays commits, tags, and file contents at a revision. Reference for printing a commit message or… git show-ref --verifygit show-ref lists refs and --verify checks that a specific ref exists, the scriptable way CI tests for a bra… git show-refgit show-ref lists refs and their object ids, and verifies a ref exists. Reference for --verify, --tags, --he… git showgit show displays a commit, tag, or object with its diff. Reference for --stat, --name-only, blob viewing, an… git sparse-checkout conegit sparse-checkout in cone mode checks out only chosen directories of a monorepo, cutting CI checkout time.… git sparse-checkoutgit sparse-checkout limits the working tree to selected paths. Reference for init, set, and cone mode to chec… git sparse-checkout setgit sparse-checkout set narrows the working tree to chosen paths. Reference for init, --cone, disable, and th… git sparse-checkoutgit sparse-checkout limits the working tree to a subset of paths, speeding monorepo CI. Reference for init, s… git stash applygit stash apply reapplies a stash but keeps it on the stack. Reference for stash@{n}, --index, and when to ch… git stashgit stash saves uncommitted changes aside. Reference for push, pop, and --include-untracked to clean the tree… git stash dropgit stash drop deletes a single stash entry; clear removes them all. Reference for stash@{n}, recovery via re… git stash listgit stash list shows the stash stack with log-style formatting. Reference for --format, stash@{n} addressing,… git stash popgit stash pop reapplies the latest stash and removes it from the stack. Reference for stash@{n}, --index, and… git stashgit stash saves uncommitted changes aside and restores a clean tree. Reference for push, pop, -u, list, and t… git statusgit status shows working tree and index state. Reference for --porcelain, the stable machine-readable format… git statusgit status shows staged, unstaged, and untracked changes plus branch state. Reference for -s, --porcelain, -b… submodule update --init --recursivegit submodule update --init --recursive clones and checks out all nested submodules. Reference for --depth, -… git submodule updategit submodule update fetches and checks out submodules. Reference for --init, --recursive, --depth, and the s… git submodulegit submodule manages nested repositories pinned to specific commits. Reference for update --init --recursive… git switch --detachgit switch --detach checks out a commit without attaching to a branch. Reference for detaching at a SHA or ta… git switchgit switch changes the current branch. Reference for -c to create branches, --detach, and the safer branch-on… git switchgit switch changes branches with a focused, modern interface. Reference for -c, --detach, --track, and the er… git symbolic-refgit symbolic-ref reads and sets symbolic refs like HEAD. Reference for finding a remote default branch reliab… git symbolic-refgit symbolic-ref reads and writes symbolic refs like HEAD, used to find or set the default branch. Reference… git tag -a / -dgit tag -a creates an annotated, metadata-rich tag; -d deletes a tag locally. Reference for -m, -s, pushing,… git taggit tag creates and lists tags. Reference for -a annotated tags and -l listing, used to cut releases and disc… git taggit tag creates and lists tags for releases. Reference for -a, -m, -d, pushing tags, and the "tag already exi… git town shipgit town ship merges a completed feature branch into trunk and removes it. Reference for --message, ship stra… git town syncgit town sync pulls and merges trunk into your branch chain. Reference for --all, --stack, the config it need… update-index --assume-unchangedgit update-index --assume-unchanged and --skip-worktree tell git to ignore changes to tracked files, with rea… git update-indexgit update-index manipulates the staging area directly. Reference for --assume-unchanged, --chmod, and --refr… git update-indexgit update-index edits the index directly, including assume-unchanged and skip-worktree. Reference for these… git update-refgit update-ref creates, updates, or deletes a ref with old-value checks. Reference for -d, --create-reflog, s… git verify-commitgit verify-commit checks the GPG/SSH signature on a commit. Reference for --raw, -v, exit codes, and the no-s… git verify-taggit verify-tag checks the signature on an annotated tag. Reference for --raw, -v, exit codes, and the lightwe… git whatchangedgit whatchanged lists commits with the files each one touched. Reference for --oneline, -p, path limiting, an… git worktree --detachgit worktree add --detach checks out a second working tree without claiming a branch, ideal for building two… git worktree addgit worktree add checks out an extra working tree from the same repo. Reference for -b, --detach, --track, an… git worktreegit worktree manages multiple working trees from one repo. Reference for add, list, and remove to check out s… git worktree listgit worktree list shows every working tree linked to the repo, with paths and branches. Reference for --porce… git worktree removegit worktree remove deletes a linked working tree and its admin files. Reference for --force, prune, and the… git worktreegit worktree checks out multiple branches into separate directories from one repo. Reference for add, list, r… actions/checkout without lfs: trueFix builds that get LFS pointers because actions/checkout ran without lfs: true in CI - the default checkout… glab auth loginglab auth login authenticates the GitLab CLI. Reference for token-based non-interactive login, --hostname for… glab ciglab ci runs, views, and traces GitLab CI pipelines from the terminal. Reference for glab ci run, status, tra… glab mr createglab mr create opens a GitLab merge request from the command line. Reference for --fill, --source-branch, --t… glab release createglab release create publishes a GitLab release and uploads assets. Reference for --notes, --assets-links, tag… glab repo cloneglab repo clone clones a GitLab project (or a whole group) using your token. Reference for group cloning, --p… gt stackgt stack (and gt restack) shows and rebuilds a Graphite branch stack. Reference for gt log, gt restack, gt sy… gt submitgt submit pushes a Graphite stack and opens or updates one PR per branch. Reference for --stack, --no-interac… hub (legacy)hub is the legacy git wrapper for GitHub, superseded by gh. Reference for hub pull-request, hub ci-status, GI… lab (legacy)lab is the older zaquestion GitLab wrapper, superseded by glab. Reference for lab mr create, lab ci status, t… sprspr (ejoffe/spr) turns each commit on a branch into a separate GitHub PR. Reference for spr update, spr statu… tea logintea login add authenticates the Gitea/Forgejo CLI with a token. Reference for --url, --token, --name, and the… tea prtea pr create, list, and merge manage Gitea/Forgejo pull requests. Reference for --head, --base, --title, --l… tea releasetea release create publishes a Gitea/Forgejo release and uploads assets. Reference for --tag, --note, --asset…

trivy-actionThe aquasecurity/trivy-action wraps Trivy for GitHub Actions. Reference for inputs like scan-type, severity,… buildah budbuildah bud (build-using-dockerfile) builds an OCI image from a Containerfile or Dockerfile without a daemon.… buildah frombuildah from creates a working container from a base image (or scratch) so you can build an image imperativel… buildah pushbuildah push uploads a locally built image to a registry or writes it to another transport, without a daemon.… cosign attestcosign attest attaches a signed SBOM or provenance attestation to an image. Reference for --predicate, --type… cosign keyscosign generate-key-pair creates a signing key pair, optionally stored in a KMS or Kubernetes secret. Referen… cosign signcosign sign attaches a signature to a container image by digest. Reference for --key, --yes, the digest requi… cosign verifycosign verify checks a container image signature against a key or a keyless identity. Reference for --key, id… cosign keylesscosign keyless signing uses a CI OIDC token and Fulcio/Rekor instead of a stored key. Reference for the setup… crane appendcrane append adds a tarball as a new layer on top of a base image and pushes the result, no Dockerfile or dae… crane copycrane copy transfers images between registries quickly without a daemon. Reference for --all-tags, --platform… crane copycrane copy (go-containerregistry) copies an image between registries without a daemon, preserving all archite… crane digestcrane digest prints the sha256 digest of an image reference so CI can pin by digest. Reference for --platform… crane digestcrane digest resolves a tag to its immutable digest without pulling the image. Reference for --platform, --fu… crane lscrane ls lists the tags of a remote repository without a daemon. Reference for authentication, --omit-digest-… crane lscrane ls lists the tags in a registry repository without a daemon. Reference for auth, scripting with the out… crane manifestcrane manifest prints the raw manifest JSON of an image reference, including multi-arch index entries. Refere… crane pull/pushcrane pull saves a remote image to a tarball and crane push uploads a tarball to a registry, both without a d… dive analyzedive inspects each image layer and reports wasted space and efficiency. Reference for the source flags, the U… dive CI rulesdive in CI mode enforces efficiency and wasted-space thresholds. Reference for CI=true, the rule env vars, .d… docker buildReference for docker build in CI: tag, file, build-arg, target, platform, no-cache, and pull flags for buildi… docker buildHow docker build works: building an image from a Dockerfile, tagging, build args, target stages, and the buil… docker builder pruneHow docker builder prune works: clearing BuildKit build cache, the -a flag, keep-storage, and freeing disk on… docker buildx bakeHow docker buildx bake works: building multiple images from an HCL/JSON bake file, target groups, variables,… docker buildx buildReference for docker buildx build in CI: --push, --cache-from, --cache-to type=gha, and multi-arch --platform… docker buildx buildHow docker buildx build works: BuildKit builds, multi-platform images, --push, and the GitHub Actions cache b… docker buildx create / useReference for docker buildx create and docker buildx use in CI: provision a builder instance with the docker-… buildx imagetoolsdocker buildx imagetools inspects a multi-arch image and creates or re-tags manifest lists on the registry, n… docker commitHow docker commit works: snapshotting a container into a new image, setting CMD, and why Dockerfiles beat com… docker compose buildReference for docker compose build in CI: build service images defined in a compose file with --no-cache, --p… docker compose buildHow docker compose build works: building images for services with a build section, --no-cache, build args, an… docker compose configReference for docker compose config in CI: validate and render the merged compose configuration with --quiet… docker compose configHow docker compose config works: validating and rendering the merged compose file with variables resolved, fo… docker compose downReference for docker compose down in CI: stop and remove containers, networks, and with -v the volumes, to te… docker compose downHow docker compose down works: stopping and removing services, networks, and volumes, the -v flag, and clean… docker compose execReference for docker compose exec in CI: run a command in a running service container with -T, -e, and -w to… docker compose execHow docker compose exec works: running a command in a running service container, the -T flag for CI, and not-… docker compose logsReference for docker compose logs in CI: view aggregated service logs with --tail, --no-color, and --timestam… docker compose logsHow docker compose logs works: viewing aggregated service logs, following, tailing per service, and debugging… docker compose psReference for docker compose ps in CI: list the status of project services with -a, --format, and --status to… docker compose psHow docker compose ps works: listing a stack services with state, health, ports, and reading exit codes in CI. docker compose pullReference for docker compose pull in CI: pre-pull service images defined in a compose file with --quiet and -… docker compose pullHow docker compose pull works: pulling images for all services, --ignore-buildable, parallelism, and rate-lim… docker compose runReference for docker compose run in CI: run a one-off command in a service container with --rm, -e, and --no-… docker compose runHow docker compose run works: starting a one-off container for a service, --rm, dependencies, and running tes… docker compose upReference for docker compose up in CI: start services from a compose file with -d, --build, and --wait so dep… docker compose upHow docker compose up works: starting all services from a compose file, detached mode, --build, --wait, and t… docker container pruneHow docker container prune works: bulk-removing all stopped containers, age filters, and CI cleanup between j… docker contextReference for docker context in CI: create, list, and switch Docker endpoints to target a remote daemon over… docker contextHow docker context works: managing and switching between Docker daemon endpoints (local, remote, cloud) and C… docker cpReference for docker cp in CI: copy files and directories between a container and the host, for extracting bu… docker cpHow docker cp works: copying files and directories between the host and a container, extracting CI artifacts,… docker execReference for docker exec in CI: run a command inside a running container with -e, -w, -u, and -i to drive mi… docker execHow docker exec works: running a command in a running container, opening a shell, env and user flags, and the… docker exportHow docker export works: flattening a container filesystem to a tar, how it differs from docker save, and CI… docker historyReference for docker history in CI: show the layers of an image with sizes and creating instructions to debug… docker historyHow docker history works: showing the layers of an image, the command and size of each, and finding what bloa… docker image pruneHow docker image prune works: removing dangling or all unused images, the -a flag, age filters, and reclaimin… docker imagesReference for docker images in CI: list local images with --filter, --format, and -q to inspect or script ove… docker imagesHow docker images works: listing local images, filtering dangling layers, custom formatting, and using it to… docker importHow docker import works: building a single-layer image from a filesystem tar, setting CMD on import, and the… docker initHow docker init works: scaffolding a Dockerfile, .dockerignore, and compose.yaml for a project, language dete… docker inspectReference for docker inspect in CI: print low-level JSON for containers, images, volumes, and networks, and e… docker inspectHow docker inspect works: dumping JSON metadata for containers, images, volumes, and networks, with --format… docker killHow docker kill works: sending SIGKILL or a custom signal to a container immediately, and how it differs from… docker loadReference for docker load in CI: import images from a tar archive produced by docker save, restoring them int… docker loadHow docker load works: restoring images saved with docker save, loading from stdin or a file, and CI cache-re… docker loginReference for docker login in CI: authenticate to a registry with -u and --password-stdin to avoid leaking cr… docker loginHow docker login works: authenticating to Docker Hub, GHCR, or ECR with a token from stdin, and the auth erro… docker logoutReference for docker logout in CI: remove stored registry credentials at the end of a job so cached auth does… docker logoutHow docker logout works: removing stored registry credentials, and why CI runners should clear credentials af… docker logsReference for docker logs in CI: fetch container stdout and stderr with --tail, --since, --timestamps, and -f… docker logsHow docker logs works: viewing stdout/stderr from a container, following, tailing, timestamps, and using it t… docker manifestReference for docker manifest in CI: create, annotate, inspect, and push multi-arch manifest lists so one tag… docker manifestHow docker manifest works: inspecting and creating multi-architecture manifest lists, the experimental flag,… docker network createReference for docker network create in CI: create a user-defined bridge network so containers can reach each… docker network createHow docker network create works: creating bridge networks for container DNS, drivers and subnets, and connect… docker network lsHow docker network ls works: listing networks, the default bridge/host/none, filtering, and debugging connect… docker network rmHow docker network rm works: deleting user-defined networks, the active-endpoints error, prune, and CI cleanu… docker pauseHow docker pause works: suspending all processes in a container via cgroup freezer, and when to use it versus… docker psReference for docker ps in CI: list running or all containers with -a, -q, --filter, and --format to inspect… docker psHow docker ps works: listing running and stopped containers, filters, format strings, and reading exit status… docker pullReference for docker pull in CI: fetch an image or all tags from a registry, pin by digest, and pull for a sp… docker pullHow docker pull works: fetching images from a registry, digests and platforms, and fixing Docker Hub rate-lim… docker pushReference for docker push in CI: publish a tagged image or all tags to a registry, with notes on authenticati… docker pushHow docker push works: uploading a tagged image to a registry, naming requirements, and the denied/unauthoriz… docker restartHow docker restart works: stopping then starting a container, the grace-period timeout, and using it to recov… docker rmReference for docker rm in CI: remove one or more containers with -f and -v to force-stop and clean up volume… docker rmHow docker rm works: removing stopped containers, force-removing running ones, removing volumes, and CI clean… docker rmiReference for docker rmi in CI: remove one or more images with -f to reclaim disk on runners and clear dangli… docker rmiHow docker rmi works: deleting images by name or ID, force removal, untagging, and the conflict errors you hi… docker runReference for docker run in CI: --rm, -e, -v, --network, -w, and --entrypoint flags for creating and starting… docker runHow docker run works: starting a container from an image, port and volume mapping, env vars, --rm cleanup, an… docker saveReference for docker save in CI: export one or more images to a tar archive with -o, for passing images betwe… docker saveHow docker save works: serializing one or more images to a tar archive with layers and metadata, for caching… docker sbom / scoutHow docker sbom and docker scout work: generating an SBOM and scanning images for CVEs, and integrating image… docker scout / scanReference for docker scout in CI: scan an image for CVEs with cves and compare, plus the deprecated docker sc… docker startHow docker start works: restarting an existing stopped container, attaching, and why start differs from run i… docker statsReference for docker stats in CI: stream or snapshot live CPU, memory, and network usage of containers with -… docker statsHow docker stats works: streaming CPU, memory, network, and I/O per container, the --no-stream flag, and spot… docker stopHow docker stop works: sending SIGTERM then SIGKILL, the grace period, stopping multiple containers, and clea… docker system dfHow docker system df works: showing disk used by images, containers, volumes, and build cache, with -v for pe… docker system pruneReference for docker system prune in CI: reclaim disk by removing stopped containers, unused networks, dangli… docker system pruneHow docker system prune works: removing stopped containers, unused networks, dangling images, and build cache… docker tagReference for docker tag in CI: add a new name and tag to an existing image so it can be pushed to a registry… docker tagHow docker tag works: giving an image a registry/repository name and tag before push, multiple tags, and nami… docker topHow docker top works: listing the processes running inside a container, ps options, and debugging hung contai… docker unpauseHow docker unpause works: resuming the processes of a container frozen by docker pause, the not-paused error,… docker volumeReference for docker volume in CI: create, list, inspect, remove, and prune named volumes for persisting or s… docker volume createHow docker volume create works: creating named volumes for persistent data, drivers and labels, and using vol… docker volume lsHow docker volume ls works: listing volumes, filtering dangling ones, formatting, and spotting volume disk bl… docker volume pruneHow docker volume prune works: bulk-removing unused volumes, the -a flag, and reclaiming volume disk on CI ru… docker volume rmHow docker volume rm works: deleting named volumes, the volume-in-use error, removing dangling volumes, and C… dockerd / DOCKER_BUILDKITReference for the dockerd daemon and the DOCKER_BUILDKIT environment variable in CI: enable BuildKit, control… grype --fail-ongrype --fail-on makes the scan exit non-zero at or above a severity. Reference for the threshold, --only-fixe… grype dbgrype db update, status, and the cache directory control the vulnerability database. Reference for offline/ca… grype scangrype scans container images, directories, and SBOMs for vulnerabilities. Reference for source prefixes, scop… jib buildJib builds container images for Java apps from Maven or Gradle without a Dockerfile or daemon. Reference for… kaniko executorkaniko /kaniko/executor builds a container image from a Dockerfile inside a container, no Docker daemon or pr… ko buildko build compiles a Go binary and packages it into a minimal container image, no Dockerfile or daemon. Refere… manifest-toolmanifest-tool combines per-arch images into one multi-arch manifest list and pushes it, without a daemon. Ref… nerdctl buildnerdctl build builds OCI images on containerd with BuildKit, Docker-compatible flags. Reference for -t, --bui… oras pulloras pull downloads the files of an OCI artifact from a registry. Reference for -o output dir, media-type fil… oras pushoras push uploads arbitrary files as OCI artifacts to a registry (SBOMs, Helm values, configs). Reference for… podman buildpodman build builds an OCI image from a Containerfile or Dockerfile. Reference for -t, -f, --build-arg, --pla… podman composepodman compose runs docker-compose.yml files via Podman. Reference for up, down, the podman-compose vs compos… podman cppodman cp copies files between a container and the host. Reference for the source:dest syntax, directories, a… podman execpodman exec runs a command inside a running container. Reference for -it, -e, -u, -w, and the not-running and… podman healthcheckpodman healthcheck and --health-cmd let CI wait until a container is healthy. Reference for the health flags,… podman imagespodman images lists images in local storage. Reference for --format, --filter, --quiet, --digests, and the st… podman inspectpodman inspect prints detailed JSON for containers, images, volumes, and networks. Reference for --format, -t… podman kube playpodman kube play creates pods and containers from a Kubernetes YAML. Reference for the play/down lifecycle, -… podman loginpodman login stores registry credentials for pushes and private pulls. Reference for --username, --password-s… podman logoutpodman logout removes cached registry credentials. Reference for logging out one or all registries and cleari… podman logspodman logs prints a container stdout and stderr. Reference for -f, --tail, --since, --timestamps, and captur… podman machinepodman machine manages the Linux VM Podman uses on macOS and Windows. Reference for init, start, the rootful… podman manifestpodman manifest builds and pushes multi-architecture image lists. Reference for create, add, push --all, and… podman networkpodman network creates and manages networks so containers can reach each other by name. Reference for create,… podman pspodman ps lists containers and their status. Reference for -a, --filter, --format, --quiet, and reading exit… podman pullpodman pull downloads an image from a registry. Reference for fully qualified names, --platform, --creds, and… podman pushpodman push uploads a local image to a registry. Reference for destination references, --creds, --tls-verify,… podman rmpodman rm deletes stopped containers. Reference for -f, -a, --volumes, and the in-use and name-conflict error… podman rmipodman rmi deletes images from local storage. Reference for -f, -a, --ignore, and the image-in-use and depend… podman runpodman run creates and starts a container from an image. Reference for -d, --rm, -e, -v, -p, and the rootless… podman save/loadpodman save exports an image to a tar archive and podman load imports it. Reference for -o, --format, and cac… podman system prunepodman system prune removes stopped containers, unused images, networks, and build cache. Reference for -a, -… podman systemdpodman generate systemd and Quadlet run containers as systemd services. Reference for --new, the user vs syst… podman tagpodman tag gives an existing image an additional name. Reference for tagging images for a registry push and t… podman volumepodman volume creates and manages named volumes for persistent data. Reference for create, ls, inspect, rm, p… regctl image copyregctl image copy mirrors an image between registries without a daemon, preserving the multi-arch index. Refe… regctl manifest getregctl manifest get prints the manifest or multi-arch index for a reference and resolves digests, all without… regctl tag lsregctl tag ls lists the tags of a remote repository without a daemon. Reference for authentication, TLS confi… rootless podmanRootless Podman runs containers as an unprivileged user via user namespaces. Reference for subuid/subgid, the… skopeo copyskopeo copy transfers an image between registries or into a local archive without a Docker daemon. Reference… skopeo copyskopeo copy transfers images between registries without a daemon. Reference for transports, --all, credential… skopeo deleteskopeo delete removes an image tag or digest from a remote registry. Reference for the docker:// transport, -… skopeo inspectskopeo inspect reads an image manifest, config, and digest without pulling it. Reference for --config, --raw,… skopeo inspectskopeo inspect prints an image manifest, config, and labels straight from a registry without pulling it. Refe… skopeo list-tagsskopeo list-tags lists all tags in a repository without pulling images. Reference for the transport syntax, j… skopeo loginskopeo login authenticates to a container registry for later copy/inspect. Reference for --username, --passwo… skopeo syncskopeo sync mirrors a repository, a set of tags, or a YAML list of images between registries. Reference for -… syft -osyft -o selects the SBOM format and can write several at once. Reference for the format names, the =file synt… syft sbomsyft catalogs packages in an image or directory to produce an SBOM. Reference for source prefixes, scope, out… SPDX vs CycloneDXsyft emits both SPDX and CycloneDX SBOMs. Reference for when each format fits, how to produce them, and the c… trivy exit-codetrivy --exit-code and --severity turn a scan into a build gate. Reference for combining the flags, exit seman… trivy ignoretrivy --ignore-unfixed hides CVEs with no fix; .trivyignore allowlists specific IDs. Reference for both, plus… trivy configtrivy config scans Terraform, Kubernetes, Dockerfiles, and Helm for misconfigurations. Reference for the misc… trivy fstrivy fs scans a directory for vulnerable dependencies, secrets, and misconfigurations. Reference for scanner… trivy imagetrivy image scans a container image for OS and language vulnerabilities. Reference for severity, scanners, fo… trivy DB cacheCaching the Trivy vulnerability database avoids slow downloads and registry rate limits in CI. Reference for… trivy sbomtrivy can emit a CycloneDX or SPDX SBOM and scan an existing SBOM for CVEs. Reference for --format, the sbom… umoci unpackumoci unpack extracts an OCI image layout into a runnable root filesystem bundle. Reference for --image, the…

argocd app createargocd app create registers an Argo CD Application from a repo path or Helm chart. Reference for --repo, --pa… argocd app diffargocd app diff shows the difference between live cluster state and Git for an Application. Reference for --r… argocd app rollbackargocd app rollback reverts an Application to a previous deployed revision from its history. Reference for hi… argocd app setargocd app set updates an existing Application: image tags, Helm values, revision, and sync policy. Reference… argocd app syncargocd app sync applies an Application to the cluster and reports the result. Reference for --prune, --revisi… argocd app waitargocd app wait blocks until an Application reaches a target health or sync state. Reference for --health, --… argocd loginargocd login authenticates the CLI to an Argo CD API server. Reference for --grpc-web, --auth-token, --insecu… argocd repo addargocd repo add registers a Git repo with Argo CD, with HTTPS or SSH credentials. Reference for --username, -… checkov (overview)checkov scans Terraform, Kubernetes, and other IaC for policy violations. Overview of checkov -d, --framework… cilium connectivity testcilium connectivity test runs end-to-end network tests across the cluster. Reference for --test, --namespace,… cilium installcilium install deploys Cilium as the cluster CNI with the cilium-cli. Reference for --version, --set, --wait,… cilium statuscilium status reports the health of the Cilium agent, operator, and Hubble. Reference for --wait, the output… conftest --policyThe conftest --policy/-p flag selects which Rego directory or bundle to evaluate. Reference for combining -p,… conftest testconftest test runs Rego policies against config files (YAML, JSON, HCL) and fails on deny rules. Reference fo… conftest verifyconftest verify runs the Rego tests (test_ rules) that ship with your conftest policies. Reference for --poli… consul connectconsul connect runs the Connect service-mesh sidecar proxy and manages CA config. Reference for the proxy and… consul membersconsul members lists the agents in a Consul datacenter with their status. Reference for -detailed, -status, a… consul validateconsul validate checks Consul agent configuration files for errors without starting the agent. Reference for… datree (deprecated)datree test policy-checked Kubernetes manifests but the project is discontinued. Reference for datree test, i… envoy validateenvoy --mode validate parses an Envoy bootstrap config and exits without serving traffic. Reference for -c, -… flux bootstrap githubflux bootstrap github installs Flux and commits its manifests to a GitHub repo. Reference for --owner, --repo… flux create helmreleaseflux create helmrelease deploys a Helm chart through Flux. Reference for --source, --chart, --values, --targe… flux create kustomizationflux create kustomization tells Flux to apply a path from a source. Reference for --source, --path, --prune,… flux create source gitflux create source git defines a GitRepository source for Flux to pull from. Reference for --url, --branch, -… flux get kustomizationsflux get kustomizations lists Kustomizations with their ready status and last applied revision. Reference for… flux reconcileflux reconcile triggers an immediate reconciliation instead of waiting for the interval. Reference for source… gator testgator test evaluates OPA Gatekeeper ConstraintTemplates and Constraints against resources without a cluster.… gator verifygator verify runs Gatekeeper suite test files that assert expected allow/deny per constraint. Reference for t… helm dependency updateReference for helm dependency update: resolve and download subcharts into charts/, rebuild Chart.lock, the di… helm dependency updatehelm dependency update downloads a chart's subcharts into charts/. The Chart.lock, build vs update, and the m… helm gethelm get retrieves the values, manifest, notes, or hooks of a deployed release. Recovering effective values i… helm historyhelm history lists a release's revisions with status and description. Picking a rollback target, --history-ma… helm installReference for helm install: install a chart as a release, set values, and use --wait and --atomic so a failed… helm installhelm install deploys a chart as a new release. Setting values, --wait and --atomic for CI, --dry-run, and the… helm lintReference for helm lint: validate a chart for structural and best-practice issues before deploy, strict mode,… helm linthelm lint checks a chart for problems before packaging or install. Linting with real values, strict mode in C… helm listhelm list shows releases and their status. All-namespaces, status filters, output formats for scripting, and… helm packagehelm package builds a chart into a versioned .tgz archive. Setting the version in CI, dependency bundling, an… helm pluginhelm plugin installs and manages Helm CLI extensions like helm-diff and helm-secrets. Pinning versions in CI,… helm pullhelm pull downloads a chart archive from a repo or OCI registry. Untarring for vendoring, OCI auth, and the c… helm repo addReference for helm repo add: register a chart repository, authenticate private repos, force-update an existin… helm repo addhelm repo add registers a chart repository locally. Private-repo auth, --force-update in CI, and the not-a-va… helm repo updateReference for helm repo update: refresh local chart-repo indexes so installs resolve the latest versions, tar… helm repo updatehelm repo update refreshes cached repository indexes. Why CI must update before install, and the stale-index… helm rollbackReference for helm rollback: revert a release to a previous revision, find the target with helm history, the… helm rollbackhelm rollback reverts a release to a previous revision. Finding the target with helm history, --wait and --fo… helm searchhelm search finds charts in your repos (search repo) or on Artifact Hub (search hub). Version listing, and wh… helm showhelm show displays a chart's metadata, default values, README, and CRDs without installing. Extracting values… helm statusReference for helm status: inspect a release state, revision, and resources, machine-readable output for CI a… helm statushelm status shows a release's current state, resources, and notes. Reading FAILED and pending states, --show-… helm templateReference for helm template: render a chart to plain Kubernetes YAML without a cluster, validate with --dry-r… helm templatehelm template renders a chart to manifests locally without a cluster. Validating values in CI, --show-only, a… helm testReference for helm test: run a release embedded test hooks to verify a deploy actually works, fetching logs o… helm testhelm test runs a release's test hooks to verify it works. Writing test pods, --logs in CI, and the no-tests a… helm uninstallReference for helm uninstall: remove a release and its resources, --keep-history and --wait flags, and a CI p… helm uninstallhelm uninstall removes a release and its resources. Keeping history with --keep-history, the --wait flag, and… helm upgradeReference for helm upgrade: update a release or install it if absent with --install, atomic rollback, --wait… helm upgradehelm upgrade changes a release to a new chart or values. The --install idempotent pattern, --atomic auto-roll… helmfile applyhelmfile apply runs a diff and only upgrades releases that changed. Reference for --selector, --environment,… helmfile destroyhelmfile destroy uninstalls every release defined in the helmfile. Reference for --selector, --environment, t… helmfile diffhelmfile diff shows what helmfile apply would change. Reference for --detailed-exitcode, --suppress-secrets,… helmfile inithelmfile init checks for and installs helm and the plugins helmfile needs (diff, secrets). Reference for --fo… helmfile templatehelmfile template renders all releases to plain YAML without touching the cluster. Reference for --output-dir… istioctl analyzeistioctl analyze detects configuration problems in Istio resources before they cause outages. Reference for -… istioctl installistioctl install deploys the Istio control plane using a profile or IstioOperator config. Reference for --set… istioctl proxy-configistioctl proxy-config dumps the live Envoy config (clusters, listeners, routes, endpoints) from a sidecar. Re… istioctl proxy-statusistioctl proxy-status shows whether Envoy sidecars are in sync with istiod. Reference for reading SYNCED/STAL… istioctl validateistioctl validate checks Istio custom resources against their schema without a cluster. Reference for -f, ref… istioctl verify-installistioctl verify-install checks that an Istio installation matches its manifest and is running correctly. Refe… istioctl x precheckistioctl x precheck verifies the cluster is ready for an Istio install or upgrade. Reference for what it chec… k9s (read-only)k9s is a terminal UI for navigating clusters interactively; in CI it is used read-only since it needs a TTY.… kics scankics scan finds misconfigurations across Terraform, Kubernetes, Docker, and more using queries. Reference for… kind create clusterkind create cluster spins up a Kubernetes cluster in Docker for tests. Reference for --name, --config, --imag… kind delete clusterkind delete cluster removes a kind cluster and its kubeconfig context. Reference for --name, --all, and clean… kind load imagekind load docker-image pushes a locally built image into the kind nodes so pods can run it without a registry… krew (install)krew is the kubectl plugin manager: search, install, upgrade, and list plugins like ns, ctx, and neat. Refere… kube-linter lintkube-linter checks manifests and Helm charts for security and reliability misconfigurations. Reference for li… kube-linter lintkube-linter lint runs static security and correctness checks on manifests and Helm charts. Reference for --co… kube-linter configA .kube-linter.yaml selects which checks run, sets exclusions, and defines custom checks. Reference for the c… kube-score scorekube-score score analyzes manifests for reliability and security best practices. Reference for --output-forma… kubeconform schemaskubeconform -schema-location points validation at a self-hosted mirror or local CRD schemas, for air-gapped C… kubeconform -strictkubeconform -strict fails on fields not present in the schema, catching typos the API server would silently d… kubeconformkubeconform validates Kubernetes manifests against JSON schemas, fast and offline. Reference for -summary, -s… kubeconform + kustomizePipe kustomize build into kubeconform - to validate the rendered manifests, not the raw overlays. Reference f… kubeconform (validate)kubeconform validates Kubernetes manifests against the OpenAPI schemas quickly and offline-capable. Reference… kubectl annotate --overwritekubectl annotate --overwrite updates an annotation idempotently. The change-cause pattern, the too-long error… kubectl annotateReference for kubectl annotate: attach non-identifying metadata to resources, the change-cause annotation for… kubectl annotatekubectl annotate sets or removes annotations on resources. Reference for --overwrite, the key- removal syntax… kubectl annotatekubectl annotate attaches non-identifying metadata to resources. Annotations vs labels, and the change-cause… kubectl api-resourceskubectl api-resources lists every resource type the cluster serves, with short names and groups. Reference fo… kubectl api-resourceskubectl api-resources lists the resource types a cluster serves, with short names and API groups. How to conf… kubectl api-versionskubectl api-versions lists the API group/versions the cluster serves. Guarding manifests against removed APIs… kubectl apply --server-sidekubectl apply --server-side computes the merge on the API server and tracks field ownership. Reference for --… kubectl apply --server-sidekubectl apply --server-side moves the merge to the API server with field managers. Why CI prefers it, the con… kubectl apply -kkubectl apply -k builds a kustomization and applies it to the cluster in one step. Reference for the flag, th… kubectl apply -kkubectl apply -k builds and applies a kustomize overlay in one step. Overlay selection in CI, the accumulatio… kubectl applyReference for kubectl apply: declarative create-or-update from manifests, server-side apply, dry-run validati… kubectl applykubectl apply declaratively creates or updates resources from manifests. Server-side apply, dry-run, and the… kubectl attachkubectl attach connects to a running container's process streams. How it differs from exec, and the connectio… kubectl auth can-iReference for kubectl auth can-i: check whether the current credentials may perform an action before attempti… kubectl auth can-ikubectl auth can-i checks whether the current (or impersonated) identity may perform an action. Reference for… kubectl auth can-ikubectl auth can-i checks RBAC permissions before you run a command. Impersonation, list mode, and using it a… kubectl auth can-ikubectl auth can-i checks whether the current credentials may perform an action. RBAC preflight in CI, --list… kubectl autoscalekubectl autoscale creates a HorizontalPodAutoscaler. Reference for --min, --max, --cpu-percent, the metrics d… kubectl certificatekubectl certificate approves or denies CertificateSigningRequests. The node-bootstrap and custom-CSR flow, an… kubectl cluster-infokubectl cluster-info shows control-plane endpoints and checks connectivity. Use it as a CI preflight; the dum… kubectl config set-contextReference for kubectl config set-context: create or modify a context and pin a default namespace so CI comman… kubectl config set-contextkubectl config set-context creates or edits a context and pins a default namespace. The --current --namespace… kubectl config use-contextReference for kubectl config use-context: switch the active kubeconfig context in CI, verify with current-con… kubectl config use-contextkubectl config use-context switches the active context (cluster, user, namespace). Reference for use-context,… kubectl config use-contextkubectl config use-context switches the active kubeconfig context. Selecting the target cluster in CI, the co… kubectl configkubectl config views and edits kubeconfig - contexts, clusters, namespaces. Switching context in CI, setting… kubectl cordon / drainReference for kubectl cordon and drain: stop new pods on a node and safely evict running ones, the DaemonSet… kubectl cordon / uncordonkubectl cordon marks a node unschedulable; uncordon reverses it. How they differ from drain, and the stuck-Pe… kubectl cp (from pod)kubectl cp pulling files out of a container to the runner. The tar dependency, path syntax, the leading-slash… kubectl cpReference for kubectl cp: copy files into or out of a container, the tar dependency that breaks distroless im… kubectl cpkubectl cp copies files between a pod and the local filesystem. Reference for the namespace/pod:path syntax,… kubectl cpkubectl cp copies files between your machine and a container. The tar dependency, path syntax, and why cp fai… create configmap --from-filekubectl create configmap --from-file builds a ConfigMap from files or a directory. Reference for --from-file,… kubectl create configmapReference for kubectl create configmap: build a ConfigMap from literals, files, or a directory, the create-pi… kubectl create configmapkubectl create configmap builds a ConfigMap from literals, files, or env files. The apply-pipe idempotency pa… kubectl create deploymentkubectl create deployment scaffolds a Deployment from an image. Replicas and port flags, generating YAML to c… kubectl create jobkubectl create job runs a one-off Job, optionally from a CronJob template. Triggering migrations in CI, waiti… kubectl create namespacekubectl create namespace makes a namespace for isolated CI environments. The idempotent create-or-apply patte… create secret docker-registrykubectl create secret docker-registry builds a dockerconfigjson pull secret. Reference for --docker-server/us… kubectl create secretReference for kubectl create secret: build generic, docker-registry, and tls Secrets from literals or files,… kubectl create secretkubectl create secret builds generic, docker-registry, and TLS Secrets. The apply-pipe idempotency idiom, bas… kubectl createReference for kubectl create: imperative resource creation, the create-then-apply pattern, --dry-run YAML gen… kubectl createkubectl create imperatively creates resources and scaffolds manifests. create vs apply, --dry-run YAML, and t… kubectl debugkubectl debug attaches an ephemeral debug container to a running pod. Debugging distroless pods, node debuggi… kubectl delete --grace-periodkubectl delete --grace-period controls termination time; --grace-period=0 --force removes a stuck pod. The ri… kubectl delete -lkubectl delete -l removes every resource matching a label. Scoped teardown in CI, the dangerous broad-selecto… kubectl deleteReference for kubectl delete: remove resources by name, label, or manifest, graceful vs force deletion, --wai… kubectl deletekubectl delete removes resources by name, label, or manifest. Graceful termination, force deletes, finalizers… kubectl describe nodekubectl describe node shows taints, conditions, allocatable, and pod pressure. Diagnosing unschedulable pods… kubectl describeReference for kubectl describe: render a resource plus its Events to debug ImagePullBackOff, CrashLoopBackOff… kubectl describekubectl describe shows a resource plus its events. Read the Events section to debug ImagePullBackOff, CrashLo… kubectl diffReference for kubectl diff: preview what an apply would change against the live cluster, the meaning of its e… kubectl diffkubectl diff shows what an apply would change against the live cluster. Reference for exit codes, --server-si… kubectl diffkubectl diff previews what an apply would change against the live cluster. Using it as a CI gate, its exit co… kubectl drain --forcekubectl drain --force evicts pods including unmanaged bare pods. The DaemonSet and local-data flags, the PDB… kubectl drainkubectl drain cordons a node and evicts its pods for maintenance. Reference for --ignore-daemonsets, --delete… kubectl drainkubectl drain safely evicts pods from a node before maintenance. DaemonSet and local-data flags, and the PodD… kubectl editkubectl edit opens a resource in your editor for in-place changes. Why it is an anti-pattern in CI, and the i… kubectl eventskubectl events lists cluster events with filtering and watch. Sorting chronologically, scoping to one object,… kubectl exec -itkubectl exec runs a command in a container; -it allocates a TTY. Reference for -c, the -- separator, why -t h… kubectl execReference for kubectl exec: run a command inside a running container, the -- separator, container selection,… kubectl execkubectl exec runs a command inside a running container. Interactive shells, the -- separator, and the connect… kubectl explainkubectl explain documents the fields of a resource type from the live API schema. Reference for --recursive,… kubectl explainkubectl explain documents a resource's fields from the live API schema. Recursive field trees, apiVersion, an… kubectl exposekubectl expose creates a Service for a Deployment or pod. Service types, target-port mapping, and the no-sele… kubectl get custom-columnskubectl get -o custom-columns builds a table from jsonpath expressions. Reference for the HEADER:path syntax,… kubectl get -o jsonpathkubectl get -o jsonpath pulls a single field for scripts and gates. Reference for the jsonpath syntax, range,… kubectl get -o jsonpathkubectl get -o jsonpath extracts exact fields for scripting. Range syntax, quoting in CI shells, and the empt… kubectl get -o widekubectl get -o wide adds node, IP, and nominated-node columns to the table. Spotting scheduling spread in CI,… kubectl get -o yamlkubectl get -o yaml dumps a resource's full spec and status as YAML. Server-side defaults, the managedFields… kubectl get componentstatuseskubectl get componentstatuses (cs) reports control-plane component health. Why it is deprecated, what to use… kubectl get events -wkubectl get events -w streams cluster events live. Watching a deploy unfold, sorting and field-selecting, and… kubectl getReference for kubectl get: list resources, output formats, label and field selectors, jsonpath extraction, an… kubectl getkubectl get lists and displays Kubernetes resources. Output formats, label selectors, watch mode, and the emp… kubectl ingress-nginxThe kubectl ingress-nginx plugin inspects the ingress-nginx controller: backends, conf, and generated nginx.c… kubectl krew installkubectl krew install adds kubectl plugins from the krew index. Installing plugins on a fresh runner, PATH set… kubectl kustomizeReference for kubectl kustomize: render a kustomize overlay to YAML, the difference from apply -k, and a CI e… kubectl kustomizekubectl kustomize builds rendered manifests from a kustomization directory. Reference for the build path, app… kubectl kustomizekubectl kustomize renders a kustomization to stdout without applying it. Overlays, the build-vs-apply -k dist… kubectl label --overwritekubectl label --overwrite changes an existing label idempotently. The already-has-a-value re-run failure and… kubectl labelkubectl label adds, changes, or removes labels on resources. Reference for --overwrite, the key- removal synt… kubectl labelReference for kubectl label: add, change, or remove labels, --overwrite for idempotent re-runs, the value-for… kubectl labelkubectl label adds, changes, or removes labels on resources. Overwriting, selector-targeted bulk labelling, a… kubectl logs --previouskubectl logs --previous reads the log of a crashed, restarted container. The key tool for CrashLoopBackOff in… kubectl logs -lkubectl logs -l streams logs from every pod matching a selector. Reference for --prefix, --max-log-requests,… kubectl logs -lkubectl logs -l streams logs from every pod matching a label. The max-log-requests cap, prefixing by pod, and… kubectl logsReference for kubectl logs: stream container output, read previous-container logs for crash loops, select con… kubectl logskubectl logs streams container logs. Previous-container logs for crash loops, multi-container selection, --si… kubectl patch (json)kubectl patch --type=json applies RFC 6902 add/replace/remove operations by path. Reference for op syntax, es… kubectl patch --type=jsonkubectl patch --type=json applies an RFC 6902 operation list at explicit paths. Path escaping, add vs replace… kubectl patchReference for kubectl patch: apply strategic-merge, JSON-merge, or JSON-patch updates from a script, when to… kubectl patch (strategic)kubectl patch with the default strategic merge type updates a resource in place. Reference for --type, -p, li… kubectl patchkubectl patch applies strategic-merge, JSON-merge, or JSON-patch updates. Patch types compared, scripting pat… kubectl port-forwardReference for kubectl port-forward: tunnel a local port to a pod or service for CI smoke tests, the readiness… kubectl port-forwardkubectl port-forward tunnels a local port to a pod or service. Reference for the port syntax, --address, back… kubectl port-forwardkubectl port-forward tunnels a local port to a pod or service. Background tunnels for CI smoke tests, and the… kubectl proxykubectl proxy opens an authenticated local proxy to the API server. Hitting the raw API in CI smoke tests, ba… kubectl replace --forcekubectl replace --force deletes and recreates a resource to get past immutable-field errors. Reference for --… kubectl replace --forcekubectl replace --force deletes and recreates a resource to change immutable fields. When to reach for it ove… kubectl replacekubectl replace overwrites a resource wholesale from a manifest. Replace vs apply, --force recreate, and the… kubectl rollout historykubectl rollout history lists a Deployment's revisions and their change-cause. Inspecting a specific revision… kubectl rollout pausekubectl rollout pause freezes a Deployment so multiple edits batch into one rollout. Canary staging in CI, an… kubectl rollout restartReference for kubectl rollout restart: trigger a fresh rolling restart with no spec change, to pick up a rota… kubectl rollout restartkubectl rollout restart triggers a rolling restart without changing the spec. Picking up rotated secrets and… kubectl rollout resumekubectl rollout resume un-pauses a Deployment and ships the batched changes as one rollout. Pairing with paus… kubectl rollout statuskubectl rollout status blocks until a Deployment, StatefulSet, or DaemonSet finishes rolling out. Reference f… kubectl rollout statusReference for kubectl rollout status: block until a rollout completes and exit non-zero on failure, the canon… kubectl rollout undoReference for kubectl rollout undo: roll a Deployment back to a previous revision, with rollout history, chan… kubectl rollout undokubectl rollout undo rolls a Deployment back to its previous or a specific revision. Automated rollback on a… kubectl rolloutkubectl rollout manages Deployment rollouts. rollout status as a deploy gate, undo to roll back, restart, and… kubectl runkubectl run launches a single pod imperatively. One-off debug pods, --rm -it throwaway containers, --restart… kubectl scaleReference for kubectl scale: set replica counts, conditional scaling with --current-replicas, why an HPA figh… kubectl scalekubectl scale sets the replica count of a workload. Reference for --replicas, --current-replicas, --resource-… kubectl scalekubectl scale sets the replica count on Deployments and StatefulSets. Conditional scaling with --current-repl… kubectl set envkubectl set env adds, changes, or removes env vars on a workload. Sourcing from ConfigMaps/Secrets, removing… kubectl set imageReference for kubectl set image: promote a Deployment to a new image tag in one command, why immutable tags m… kubectl set imagekubectl set image updates the image of a container in a workload and triggers a rollout. Reference for the co… kubectl set imagekubectl set image promotes a Deployment to a new image tag and triggers a rollout. The CI deploy step, contai… kubectl set resourceskubectl set resources patches CPU and memory requests and limits on a workload. Right-sizing in CI, the unsch… kubectl setkubectl set updates specific fields on existing resources - image, env, resources. The go-to command for CI i… kubectl taint nodeskubectl taint nodes adds or removes node taints that repel pods without tolerations. Taint effects, removing… kubectl taintkubectl taint adds or removes node taints with NoSchedule/NoExecute effects. Reference for the key=value:effe… kubectl taintkubectl taint adds or removes node taints that repel pods without tolerations. Taint effects, removing a tain… kubectl top podskubectl top pods shows live CPU and memory from the metrics API. Reference for --containers, --sort-by, -l, a… kubectl topReference for kubectl top: show live CPU and memory for nodes and pods, sorting and per-container breakdown,… kubectl topkubectl top shows live CPU and memory usage for pods and nodes. Sorting, container breakdown, and the metrics… kubectl uncordonkubectl uncordon makes a previously cordoned node schedulable again. The forgotten-uncordon trap that strands… kubectl versionkubectl version reports client and server versions. The skew policy, scripting with -o json, and the connecti… kubectl waitkubectl wait blocks until a resource reaches a condition, the way a pipeline gates a deploy. Reference for --… kubectl wait --for=conditionkubectl wait --for=condition blocks until a resource reaches a condition. Gating CI on Ready/Available, the t… kubectl waitReference for kubectl wait: block on a condition (Ready, Available, complete, delete) with a timeout, the rig… kubectl waitkubectl wait blocks until a resource meets a condition. Waiting for Ready, deletion, or custom conditions in… kubectl-neatkubectl neat removes server-added fields (status, managedFields, default values) from get -o yaml output for… kubectx (rename)kubectx renames long EKS/GKE context names to short aliases and deletes stale ones. Reference for the NEW=OLD… kubectx (switch)kubectx switches between kubeconfig contexts, lists them, and jumps back with the - shortcut. Reference for s… kubens (switch)kubens sets the default namespace for the current context so you stop typing -n everywhere. Reference for sel… kubentkubent (kube-no-trouble) finds deprecated and removed Kubernetes APIs in a live cluster or manifests. Referen… kubeseal --fetch-certkubeseal --fetch-cert exports the controller public certificate so you can seal secrets without cluster acces… kubeseal (seal)kubeseal encrypts a Kubernetes Secret into a SealedSecret safe to commit. Reference for --format, --scope, --… kubeval to kubeconformkubeval is archived; kubeconform is the maintained replacement. Reference mapping kubeval flags to kubeconfor… kubeval (deprecated)kubeval validated Kubernetes manifests against schemas but is deprecated in favor of kubeconform. Reference f… kubeval (validate)kubeval validates Kubernetes manifests against JSON schemas. Reference for --strict, --kubernetes-version, an… kumactl applykumactl apply creates or updates Kuma resources and policies from YAML. Reference for -f, --dry-run, variable… kumactl inspectkumactl inspect shows the state of Kuma dataplanes, meshes, and policies. Reference for the inspect subcomman… kustomization.yamlkustomization.yaml is the file Kustomize reads to render manifests. Reference for apiVersion, kind, resources… Kustomize load restrictorThe --load-restrictor flag controls whether Kustomize may read files outside the kustomization directory. Ref… Kustomize basesA Kustomize base is a directory of shared manifests that overlays reference. Reference for the base/overlay l… kustomize build overlaykustomize build renders a directory into final manifests on stdout. Reference for building overlays, output r… kustomize build (note)The standalone kustomize build renders an overlay to plain manifests, often piped into validators. Reference… commonAnnotationsThe commonAnnotations field adds annotations to every resource. Reference for the field, template propagation… Kustomize componentsA Kustomize Component is a reusable, composable unit of patches and resources. Reference for kind Component,… configMapGeneratorconfigMapGenerator builds ConfigMaps from files, literals, or env files with a content hash suffix. Reference… kustomize createkustomize create scaffolds a kustomization.yaml in the current directory. Reference for --resources, --autode… kustomize edit addkustomize edit add and set modify kustomization.yaml from the command line. Reference for add resource, set i… kustomize edit set imagekustomize edit set image pins an image tag in kustomization.yaml from CI. The name-must-match-images trap and… generatorOptionsgeneratorOptions tunes ConfigMap and Secret generators: disable the hash suffix, add labels and annotations.… kustomize helmChartsKustomize can inflate Helm charts via helmCharts when run with --enable-helm. Reference for the fields, the f… Kustomize imagesThe images field rewrites container image names, tags, and digests across manifests. Reference for newName, n… JSON 6902 patchJSON 6902 patches apply precise add/replace/remove operations to manifests. Reference for the op/path/value s… Kustomize labelsThe labels and commonLabels fields add labels across resources. Reference for includeSelectors, the selector-… namePrefix / nameSuffixnamePrefix and nameSuffix prepend or append to every resource name and update references. Reference for the f… Kustomize namespaceThe namespace field sets metadata.namespace on every namespaced resource. Reference for behavior, reference r… Kustomize replacementsThe replacements field copies a value from a source field into target fields across resources. Reference for… Kustomize resourcesThe resources field lists the manifests and directories Kustomize includes. Reference for files vs directorie… secretGeneratorsecretGenerator builds Secrets from files, literals, or env files with a hash suffix. Reference for type, the… Strategic-merge patchStrategic-merge patches let Kustomize overlay partial manifests onto resources. Reference for the patches fie… Kustomize varsThe vars field injects a value from one resource into fields of others. Reference for fieldref, objref, the d… kyverno applykyverno apply runs Kyverno policies against manifests outside a cluster, ideal for PR gates. Reference for --… kyverno testkyverno test runs declarative test cases (kyverno-test.yaml) asserting expected policy results. Reference for… linkerd checklinkerd check runs extensive health checks against a Linkerd install and control plane. Reference for --pre,… linkerd injectlinkerd inject adds the Linkerd proxy sidecar annotation to Kubernetes manifests. Reference for --manual, --e… linkerd installlinkerd install renders the Linkerd control-plane manifests to apply with kubectl. Reference for --crds, iden… linkerd vizlinkerd viz installs the metrics extension and queries live traffic stats. Reference for install, check, stat… meshctl checkmeshctl check validates a Gloo (Gloo Mesh / Gloo Gateway) install and its config. Reference for the checks it… meshctl installmeshctl install deploys Gloo (Gloo Mesh / Gloo Gateway) with the meshctl CLI. Reference for --version, --set,… minikube image loadminikube image load makes a locally built image available to the cluster without a registry. Reference for im… minikube startminikube start launches a single-node Kubernetes cluster via a driver (docker, kvm2, etc.). Reference for --d… opa evalopa eval evaluates a Rego query against input data, the core of policy-as-code checks. Reference for -d, -i,… opa fmtopa fmt formats Rego to a canonical style and, with --fail, gates PRs on unformatted files. Reference for --l… opa testopa test runs Rego unit tests (rules prefixed test_) and reports pass/fail. Reference for -v, --coverage, --t… pluto detect-filespluto detect-files scans manifests and charts for deprecated or removed Kubernetes APIs before an upgrade. Re… polaris auditpolaris audit checks manifests against configurable best-practice policies and can fail on a score threshold.… regula runregula run evaluates OPA/Rego rules against Terraform IaC and reports rule results. Reference for --input-typ… sops --decryptsops --decrypt decrypts a sops file to stdout for use in a pipeline. Reference for --output-type, SOPS_AGE_KE… sops --encryptsops --encrypt encrypts values in YAML, JSON, and env files while leaving keys readable. Reference for --age,… sops exec-envsops exec-env decrypts a file and runs a command with its values as environment variables. Reference for exec… stern (namespaces)stern can tail pods across many namespaces with -A or repeated -n flags. Reference for --all-namespaces, --na… stern (tail logs)stern tails logs from multiple pods matching a regex, with color-coded prefixes. Reference for the query argu… terrascan scanterrascan scan runs Rego policies against Terraform, Kubernetes, and other IaC. Reference for -i, -t, --polic…

.prettierignore.prettierignore lists paths Prettier should skip, using gitignore syntax. Reference for patterns, defaults, a… ajv validateajv validate checks JSON/YAML data against a JSON Schema using Ajv. Reference for -s, -d, -r, --spec, and the… astro buildastro build compiles an Astro site to dist/, static or SSR depending on adapter. Reference for the build, ast… babel src -d libbabel src -d lib compiles a source tree to a distributable lib/. Reference for -d, --extensions, --copy-files… biome --reporter=githubThe --reporter=github flag makes Biome emit GitHub Actions annotations so diagnostics appear inline on pull r… Biome assistThe v2 assist section configures source actions like organize imports and key sorting. Reference for actions,… biome check --applybiome check --apply was the Biome v1 flag for applying fixes; v2 renamed it to --write. Reference for the v1… biome check --writebiome check --write applies safe fixes, formatting, and import sorting in one pass. Reference for --write, --… biome checkbiome check runs the formatter, linter, and import sorting together and reports every issue. Reference for pa… biome cibiome ci is a check variant designed for pipelines: it never writes and reports format, lint, and import issu… biome explainbiome explain prints documentation for a lint rule or diagnostic category from the CLI. Reference for usage a… Biome files.includesThe files section selects and ignores paths with globs, and ignoreUnknown skips unsupported types. Reference… biome format --writebiome format --write rewrites files to match the formatter. Reference for --write, --staged, --changed, and a… biome formatbiome format checks or applies formatting. Reference for --write, --check behavior, indent and quote options,… biome lintbiome lint runs only the linter, skipping the formatter. Reference for --write, --only, --skip, rule selectio… Biome linter.rulesThe linter.rules section sets rule groups, severities, and the recommended baseline. Reference for recommende… biome migrate eslintbiome migrate eslint translates an ESLint config into biome.json. Reference for --write, --include-inspired,… biome migrate prettierbiome migrate prettier translates .prettierrc and .prettierignore into biome.json. Reference for --write and… Biome organize importsBiome sorts and groups imports as part of check. Reference for the v1 organizeImports key, the v2 assist acti… Biome overridesThe overrides array applies different formatter or linter settings to specific globs. Reference for include,… Biome vcs configThe vcs section in biome.json connects Biome to git for ignore files and changed-file runs. Reference for ena… biome-ignore commentThe biome-ignore comment suppresses a specific rule on the next line. Reference for the syntax, scope, and th… biome.jsonbiome.json (or biome.jsonc) configures the formatter, linter, files, and VCS. Reference for $schema, top-leve… bun addbun add installs a package and records it in package.json and the lockfile. Reference for --dev, --optional,… bun buildbun build bundles JS/TS into output files with Bun's native bundler. Reference for --outdir, --target, --mini… bun createbun create scaffolds a project from a template or a create-* package, like npm create. Reference for template… bun execbun exec runs a one-off command string through Bun Shell from the terminal, portable across platforms. Refere… bun initbun init scaffolds a minimal Bun project with package.json, tsconfig, and a gitignore. Reference for -y, what… bun --frozen-lockfileThe --frozen-lockfile flag makes bun install fail if the lockfile would change, the key to reproducible CI. R… bun installbun install resolves and installs dependencies from package.json into node_modules using bun.lock. Reference… bun linkbun link registers a local package globally and links it into another project for local development. Referenc… bun outdatedbun outdated reports which dependencies have newer versions available. Reference for reading the table, filte… bun patchbun patch lets you edit an installed dependency and persist the change as a committed patch. Reference for th… bun pmbun pm is a set of utilities for the package manager: cache path, ls, bin, hash, trust. Reference for bun pm… bun publishbun publish packs and publishes a package to the registry. Reference for --access, --tag, --dry-run, --otp, a… bun removebun remove uninstalls a package and drops it from package.json and the lockfile. Reference for usage, what it… bun runbun run executes package.json scripts and JS/TS files with the Bun runtime. Reference for --bun, --filter, --… Bun Shell ($)Bun Shell runs shell-like commands from JavaScript with the $`...` tagged template, portable across platforms… bun testbun test runs a fast Jest-compatible test runner built into Bun. Reference for --coverage, --watch, --timeout… bun updatebun update upgrades dependencies within their semver ranges and refreshes the lockfile. Reference for --lates… bun upgradebun upgrade updates the Bun binary to the latest release (or canary). Reference for --canary, version pinning… Bun workspacesBun workspaces let one install manage many packages in a monorepo via the workspaces field. Reference for set… bun.lock / bun.lockbBun records resolved dependencies in bun.lock (text) or the legacy bun.lockb (binary). Reference for the form… bunfig.tomlbunfig.toml configures Bun: registries and auth, install behavior, test coverage thresholds, and runtime opti… bunx (bun x)bunx (bun x) downloads and runs a package binary on demand, like npx. Reference for --bun, version pinning, c… corepackCorepack ships with Node and pins the exact yarn/pnpm version via packageManager in package.json - essential… CorepackCorepack ships with Node and pins pnpm/yarn via packageManager in package.json. Reference for corepack enable… datamodel-codegendatamodel-code-generator turns OpenAPI or JSON Schema into Python Pydantic/dataclass models. Reference for --… deno adddeno add records a jsr or npm dependency in the imports map of deno.json. Reference for jsr/npm specifiers, v… deno benchdeno bench runs Deno.bench performance benchmarks. Reference for --json, --filter, permission flags, and the… deno bundledeno bundle emits a single JavaScript file from a module graph. Reference for its Deno 1 deprecation, the Den… deno cachedeno cache downloads and compiles a module graph into DENO_DIR ahead of running. Reference for --frozen, --re… deno checkdeno check type-checks TypeScript without executing it. Reference for --all, --doc, --no-remote, and the type… deno compiledeno compile bakes a script and its dependencies into a single executable. Reference for --output, --target,… deno coveragedeno coverage turns the data from deno test --coverage into reports. Reference for --lcov, --html, include/ex… deno docdeno doc extracts documentation from exported symbols and can lint for missing docs. Reference for --json, --… deno evaldeno eval runs a snippet of code passed on the command line. Reference for --ext, permission flags, and using… deno fmtdeno fmt formats code with the built-in formatter and --check verifies formatting in CI. Reference for --chec… deno infodeno info prints the dependency graph of a module or shows cache locations. Reference for --json, DENO_DIR pa… deno installdeno install caches project dependencies and installs global script tools. Reference for the Deno 2 dependenc… deno lintdeno lint runs the built-in linter over your code. Reference for rule selection, --rules, --json output, and… deno permission flagsA reference for Deno permission flags: --allow-net, --allow-read, --allow-env, scoped grants, and the Deno 2… deno publishdeno publish ships a package to the JSR registry. Reference for --dry-run, --allow-dirty, OIDC from CI, and t… deno repldeno repl starts an interactive shell for trying code. Reference for --eval, permission flags, and why intera… deno rundeno run executes a TypeScript or JavaScript entry point under the permission sandbox. Reference for permissi… deno taskdeno task runs scripts defined in deno.json, like npm scripts. Reference for task definitions, argument passi… deno testdeno test discovers and runs test files with the built-in runner. Reference for --coverage, --filter, permiss… deno upgradedeno upgrade updates the Deno binary to a chosen version. Reference for --version, --canary, and why CI shoul… deno vendordeno vendor copies remote dependencies into a local folder for offline builds. Reference for the Deno 1 comma… deno.json configdeno.json configures tasks, imports, fmt, lint, and compiler options for a project. Reference for the key fie… esbuild --bundleesbuild --bundle --minify produces a bundled, minified output extremely fast. Reference for --outfile, --plat… eslint-config-prettiereslint-config-prettier disables ESLint rules that conflict with Prettier so the two tools cooperate. Referenc… fnmfnm is a fast Rust-based Node version manager. Reference for fnm install/use, fnm env --use-on-cd, .node-vers… graphql-codegengraphql-codegen generates typed code from a GraphQL schema and operations. Reference for --config, --check, -… graphql-inspector diffgraphql-inspector diff compares two GraphQL schemas and flags breaking, dangerous, and safe changes. Referenc… graphql-inspector validategraphql-inspector validate checks GraphQL documents (queries/mutations) against a schema. Reference for the a… graphql-schema-lintergraphql-schema-linter checks a GraphQL SDL schema against style and correctness rules. Reference for --rules,… n (Node)n installs and activates Node versions into a system prefix, no shims or sourcing. Reference for n <version>,… next buildnext build compiles a Next.js app for production into .next. Reference for --debug, --no-lint, environment ha… ng build productionng build --configuration production builds an optimized Angular app. Reference for --configuration, --output-… node heap sizeRaise Node’s V8 heap limit with --max-old-space-size to stop "JavaScript heap out of memory" crashes in CI bu… nodenvnodenv manages Node versions via shims and .node-version, the rbenv model. Reference for install, local/globa… npm audit fixnpm audit fix updates vulnerable dependencies to safe versions. Learn how to use it safely in CI without surp… npm audit fixnpm audit fix auto-upgrades vulnerable dependencies within semver. Usage, the --force escape hatch and its br… npm auditUse npm audit in CI to find known vulnerabilities in your dependency tree, control severity thresholds, and a… npm auditnpm audit reports known vulnerabilities in your dependency tree. Usage, --audit-level, JSON output, and why i… npm cacheManage the npm cache in CI: clean a corrupt cache, verify integrity, and understand why a forced clean is rar… npm cache cleannpm cache clean --force clears the local npm cache; npm cache verify is the safer modern fix. Usage and why -… npm cinpm ci installs exactly what is in package-lock.json, deletes node_modules first, and is the right install co… npm cinpm ci does a clean, reproducible install from package-lock.json - the right command for CI. Usage, flags, an… npm configConfigure npm in CI: set registries, auth tokens via .npmrc, cache paths, and behavior flags safely. npm confignpm config gets and sets npm settings and writes .npmrc. Usage for registry, tokens, and cache, plus the env-… npm dedupenpm dedupe simplifies the dependency tree by sharing compatible versions, reducing install size and duplicate… npm dedupenpm dedupe flattens duplicate dependencies in node_modules to reduce install size and conflicts. Usage, what… npm deprecatenpm deprecate marks a published version (or range) with a warning shown on install. Usage to set and clear de… npm dist-tagnpm dist-tag adds, removes, and lists the named tags (latest, beta, next) that map to package versions. Usage… npm exec (npx)npm exec (and npx) runs a package binary, installing it on demand. Usage, the -- separator, --yes for CI, and… npm execnpm exec runs a command from a local or remote package, the engine behind npx. Useful for one-off tools in CI. npm fundnpm fund lists the dependencies that ask for funding and their URLs. Usage and how to silence the post-instal… npm initnpm init scaffolds a package.json or runs a create-* initializer. Usage for -y, scoped inits, and the common… npm installnpm install resolves and installs dependencies and can edit the lockfile. Learn the flags that make it safe a… npm installWhat npm install does, the flags you actually use, and the install failures that break CI builds - ERESOLVE,… npm linknpm link symlinks a local package into another project for development. Usage in two steps, the global prefix… npm loginnpm login authenticates to a registry for the interactive user - but CI should use a token, not npm login. Us… npm lsnpm ls prints the installed dependency tree. Use it in CI to debug version conflicts, missing peers, and dupl… npm lsnpm ls prints the installed dependency tree and is the fastest way to debug which version of a package resolv… npm outdatednpm outdated lists which dependencies have newer versions, separating in-range (Wanted) from latest. Usage, J… npm ownernpm owner adds, removes, and lists the maintainers of a published package. Usage and the permission errors yo… npm packnpm pack creates the exact tarball npm would publish. Use it in CI to verify package contents before release. npm packnpm pack builds the exact tarball npm publish would upload - the best way to preview package contents in CI b… npm prunenpm prune deletes packages not listed in package.json. Use --omit=dev to strip devDependencies for production… npm prunenpm prune removes packages from node_modules that are not in package.json, and --omit=dev strips devDependenc… npm publishPublish packages from CI with npm publish: provenance, access, dist-tags, and token auth done safely. npm publishHow npm publish ships a package to the registry, scoped/access flags, and the E403/E409 auth and version-exis… npm rebuildnpm rebuild recompiles native modules against the current Node/OS without a reinstall - the fix for cached no… npm runnpm run executes scripts defined in package.json. Learn passing args, the -- separator, and exit-code behavio… npm runHow npm run executes package.json scripts, passing args with --, and the "missing script" error that fails CI… npm searchnpm search finds packages in the registry by keyword. Usage, JSON output, and why it can fail or hang against… npm starnpm star marks a package as a favorite on your registry account, and npm unstar removes it. Usage, listing yo… npm startnpm start runs your start script (or node server.js by default). Usage and the common CI failures - missing s… npm testnpm test runs the test script. Learn how exit codes, CI=true, and reporters interact in pipelines. npm testnpm test runs your test script and its exit code decides the CI verdict. Usage, passing flags, and the exit-c… npm unlinknpm unlink removes a symlinked package created by npm link and restores the real dependency. Usage and the re… npm updatenpm update upgrades dependencies within their semver ranges and rewrites the lockfile. Usage, what it will an… npm versionnpm version bumps the version in package.json, commits, and tags. Learn how to use it in automated release pi… npm versionnpm version bumps package.json, commits, and tags in one step. Usage for patch/minor/major and the "git worki… npm viewnpm view (npm info) queries registry metadata - versions, dist-tags, dependencies - for any package. Usage, f… npm whoaminpm whoami prints the username for your current registry token - the fastest auth smoke test in release CI. U… npxnpx runs a command from a package, fetching it if needed. Learn safe, deterministic npx usage in CI. nuxt buildnuxt build produces a production Nuxt server bundle in .output. Reference for nuxt build vs generate, --prere… nvm command not foundnvm is a shell function on no PATH, so "nvm: command not found" is the top CI failure. Reference for sourcing… nvm + .nvmrcnvm install and nvm use switch Node versions and read .nvmrc. Reference for the commands, flags, and why "nvm… oasdiff breakingoasdiff breaking compares two OpenAPI specs and flags breaking changes. Reference for the base/revision args,… openapi-diffopenapi-diff compares two OpenAPI documents and reports whether changes are breaking. Reference for --fail-on… openapi-generator generateopenapi-generator-cli generate scaffolds API clients, servers, and models from an OpenAPI spec. Reference for… openapi-typescriptopenapi-typescript converts an OpenAPI schema into TypeScript type definitions. Reference for --output, --roo… parcel buildparcel build creates an optimized production bundle with no config. Reference for --dist-dir, --public-url, -… Prettier version pinningDifferent Prettier versions can format the same file differently. Reference for pinning the version so pretti… Biome version pinningPinning @biomejs/biome and the biome.json $schema keeps CI stable across formatter and rule changes. Referenc… pnpm -rpnpm -r runs install or scripts across all workspace packages. Learn topological ordering and filtering for C… pnpm addpnpm add installs and records dependencies with workspace-aware flags. Learn -D, -E, and --filter usage. pnpm addpnpm add installs a package and saves it to package.json, with -w for the root and --filter for a specific pa… pnpm deploypnpm deploy creates a self-contained, isolated copy of a workspace package for production - ideal for Docker… pnpm dlxpnpm dlx downloads and runs a package in a throwaway environment, the pnpm equivalent of npx and yarn dlx. pnpm dlxpnpm dlx fetches and runs a package binary in a temporary environment - pnpm's npx. Usage, the --package flag… pnpm execpnpm exec runs a binary from node_modules; pnpm dlx fetches and runs one temporarily. Learn safe CI usage. pnpm installpnpm install uses a content-addressed store for fast, space-efficient installs. Learn the frozen-lockfile fla… pnpm installpnpm install resolves dependencies into the content-addressable store and links node_modules. Usage, --frozen… pnpm patchpnpm patch and pnpm patch-commit let you fix a dependency in place and persist the change in your repo. Usage… pnpm recursive (-r)The pnpm -r / --recursive flag runs a command across every workspace package in topological order. Usage, --f… pnpm runpnpm run executes scripts; pnpm -r run executes a script across every workspace. Learn the CI patterns. pnpm runpnpm run executes package.json scripts, with --filter and -r to run across workspaces. Usage, arg passing, an… pnpm storeManage the pnpm content-addressed store in CI: find its path for caching and prune unreferenced packages. pnpm store prunepnpm store prune removes orphaned packages from the global content-addressable store to reclaim disk. Usage,… pnpm updatepnpm update (pnpm up) upgrades dependencies within or across ranges with --latest, and -r across workspaces.… pnpm whypnpm why shows which dependencies pull in a package and at what version - for debugging duplicates. Usage, -r… postcss --configpostcss transforms CSS through plugins like autoprefixer. Reference for --config, --output, --dir, --use, and… prettier --cacheprettier --cache skips files unchanged since the last run, speeding up CI. Reference for --cache, --cache-loc… prettier --checkprettier --check reports whether files are formatted without rewriting them and exits non-zero if not. Refere… prettier -lprettier --list-different prints only the paths of unformatted files and exits 1 if any. Reference for the fl… prettier --no-configprettier --no-config skips config discovery and uses defaults. Reference for the flag, --config-precedence, a… prettier --writeprettier --write rewrites files to match Prettier output. Reference for the flag, how it differs from --check… Prettier CLI optionsA reference to the Prettier CLI flags that matter for pipelines: --check, --write, --config, --ignore-path, -… Prettier config filePrettier reads .prettierrc, prettier.config.js, or a prettier key in package.json. Reference for the supporte… Prettier endOfLineendOfLine controls line endings (default lf). Reference for lf/crlf/cr/auto and the Windows CRLF failures tha… Prettier overridesThe overrides array applies different Prettier options to specific file globs. Reference for the schema, comm… Prettier pluginsPrettier plugins add parsers (PHP, XML) or behavior (import sorting, Tailwind). Reference for the plugins opt… Prettier printWidthprintWidth is the line length Prettier tries to stay under (default 80). Reference for the option, how it int… Prettier semiThe semi option controls trailing semicolons (default true). Reference for the setting, what false does, and… Prettier singleQuotesingleQuote chooses single or double quotes (default double). Reference for the option, jsxSingleQuote, quote… Prettier tabWidthtabWidth sets indentation size and useTabs picks tabs vs spaces. Reference for both options, their defaults,… Prettier trailingCommatrailingComma controls trailing commas in multi-line literals. Reference for all/es5/none, the Prettier 3 def… prettier-ignore commentA // prettier-ignore comment tells Prettier to leave the next node unformatted. Reference for the comment syn… prism mockprism mock serves a mock HTTP API from an OpenAPI file, returning example or generated responses. Reference f… prism proxyprism proxy forwards requests to a real API and validates traffic against the OpenAPI spec. Reference for the… quicktypequicktype generates typed models from JSON, JSON Schema, or GraphQL. Reference for --src-lang, --lang, --out,… redocly build-docsredocly build-docs renders an OpenAPI file into a standalone Redoc HTML page. Reference for --output, --theme… redocly bundleredocly bundle merges a multi-file OpenAPI description into one document. Reference for --output, --dereferen… redocly lintredocly lint validates an OpenAPI description against a configured ruleset. Reference for --format, --max-pro… rollup -crollup -c builds from rollup.config.js, the standard way to bundle libraries. Reference for -c, --environment… rover graph checkrover graph check validates a proposed GraphQL schema against a GraphOS graph for breaking changes and failin… rover subgraph publishrover subgraph publish uploads a subgraph schema to Apollo GraphOS and recomposes the supergraph. Reference f… rspack buildrspack build runs a fast, webpack-compatible production build in Rust. Reference for --mode, --config, and th… Prettier in CIHow to gate CI on Prettier: prettier --check . as a step, caching, version pinning, and reading the exit code… sass src:distThe Dart Sass CLI compiles .scss/.sass to CSS. Reference for the src:dist mapping, --style compressed, --no-s… schemathesis runschemathesis run generates and sends test cases from an OpenAPI or GraphQL schema and checks responses. Refer… spectral lintspectral lint checks an OpenAPI or AsyncAPI document against a ruleset. Reference for --ruleset, --fail-sever… swagger-cli validateswagger-cli validate checks an OpenAPI/Swagger file for schema and $ref errors. Reference for validate, bundl… swagger-codegenswagger-codegen generate scaffolds clients and server stubs from a Swagger/OpenAPI spec. Reference for -i, -l… swc src -d distswc src -d dist transpiles a TypeScript/JSX tree to JavaScript quickly, a Babel replacement. Reference for -d… tailwindcss --minifyThe Tailwind CLI scans your content, generates utilities, and minifies. Reference for -i, -o, --minify, --con… terser -c -mterser -c -m compresses and mangles JavaScript for production. Reference for -c, -m, --source-map, --ecma, an… tsc --buildtsc --build compiles TypeScript project references in dependency order with incremental caching. Reference fo… tsc --noEmittsc --noEmit type-checks a TypeScript project without emitting files, the standard CI type gate. Reference fo… tsup --dtstsup bundles TypeScript libraries and emits .d.ts declarations with --dts. Reference for --format, --dts, --c… svelte-kit buildSvelteKit builds through vite build with an adapter, and typechecks with svelte-check. Reference for the buil… vite buildvite build produces an optimized production bundle with Rollup under the hood. Reference for --mode, --outDir… vite previewvite preview serves the dist/ output over a local static server to smoke-test a production build. Reference f… Volta cacheCaching $VOLTA_HOME speeds Volta in CI. Reference for the cache layout, VOLTA_HOME, shim PATH order, and the… Volta pinVolta pins Node, npm, and package tools per project via package.json. Reference for volta install, volta pin,… vue-cli-service buildvue-cli-service build produces a production Vue CLI bundle. Reference for --mode, --dest, --modern, --report,… vue-tsc --noEmitvue-tsc type-checks Vue single-file components including <template> bindings. Reference for --noEmit, -p, --b… webpack --configwebpack --config selects which config file to build with, enabling separate dev and prod setups. Reference fo… webpack --modewebpack --mode production enables minification and tree-shaking for release builds. Reference for --config, -… yarn frozenUnderstand --frozen-lockfile (Yarn 1) vs --immutable (Yarn 2+): both guarantee CI installs cannot silently ch… yarn addyarn add installs and records a dependency. Learn dev, exact, and peer flags, and why CI rarely runs it. yarn addyarn add installs a package and saves it to package.json. Usage for dev, exact, and peer deps, and the "could… yarn cache cleanyarn cache clean clears the global Yarn cache to recover from corrupted or checksum-mismatched packages. Usag… yarn dlxyarn dlx is Yarn Berry’s npx equivalent: download and run a package in a temporary environment. yarn dlxyarn dlx (Berry) downloads and runs a package binary in a temporary environment - yarn's npx. Usage, the -p p… yarn installyarn install resolves and installs dependencies. Learn the immutable/frozen-lockfile flags that make CI repro… yarn installyarn install resolves and installs dependencies from yarn.lock. Usage, the --immutable / --frozen-lockfile CI… yarn removeyarn remove uninstalls a package and updates package.json and yarn.lock. Usage and the "not specified in pack… yarn runyarn run executes package.json scripts and local binaries. Learn arg passing and CI exit-code behavior. yarn runyarn run executes package.json scripts (and you can omit "run"). Usage, arg passing, and the "command not fou… yarn upgradeyarn upgrade (Yarn 1) and yarn up (Berry) bump dependencies and the lockfile. Usage, the version-range gotcha… yarn whyyarn why explains why a package is installed - which dependencies pull it in. The go-to command for debugging… yarn workspacesRun commands across a Yarn monorepo: yarn workspaces foreach, focus, and per-workspace scripts in CI. yarn workspacesyarn workspaces runs commands across a monorepo and yarn workspace targets one package. Usage, the foreach pa…

./configure./configure probes the system and generates Makefiles for an autotools project. Reference for --prefix, --hos… ab POST / -kab -p posts a body file with -T content type and -k enables KeepAlive. Reference for POST load testing with A… ab (ApacheBench)ab (ApacheBench) sends -n total requests at -c concurrency and reports per-percentile times. Reference for -n… actionlintactionlint statically checks .github/workflows YAML for syntax, expression, and shell errors. Reference for r… actionlint configactionlint reads .github/actionlint.yaml to declare self-hosted runner labels and config variables. Reference… addr2lineaddr2line maps addresses back to file:line using debug info. Reference for -e, -f, -C, -p, and symbolizing cr… ajv-cli compileajv compile checks that a JSON Schema is itself valid and compiles under strict mode. Reference for --strict,… ajv-cli validateajv-cli validate checks a JSON or YAML data file against a JSON Schema with -s and -d. Reference for the flag… antora generateantora generate builds a documentation site from AsciiDoc across multiple git repos. Reference for the playbo… apksignerapksigner signs an APK with a keystore and verifies signatures (v1-v4). Reference for sign, verify, --ks, --k… arar creates and manages static library (.a) archives. Reference for rcs, t, x, and the "archive has no index"… artillery reportartillery report converts a run JSON output into a shareable HTML report. Reference for -o, the deprecation n… artillery runartillery run executes a YAML scenario and fails CI when ensure thresholds are breached. Reference for run fl… asciidoctor-pdfasciidoctor-pdf renders AsciiDoc directly to PDF without a LaTeX toolchain. Reference for -o, -a pdf-theme, -… asciidoctorasciidoctor converts AsciiDoc source to HTML5. Reference for -D, -o, --failure-level, -a attributes, and the… autocannonautocannon -c connections -d duration -p pipelining benchmarks HTTP from Node. Reference for the flags and fa… autocannon POSTautocannon -m POST -b -H load-tests write endpoints and can gate CI programmatically. Reference for POST flag… autoconfautoconf generates a configure script from configure.ac. Reference for autoreconf, aclocal, and the "possibly… automakeautomake generates Makefile.in from Makefile.am. Reference for --add-missing, foreign mode, and the "required… autoreconf -iautoreconf -i regenerates configure and Makefile.in from configure.ac and Makefile.am. Reference for -i, -f,… avdmanager create avdavdmanager create avd defines an Android Virtual Device from a system image. Reference for -n, -k, -d, --forc… b2 (Boost.Build)b2 is the Boost.Build engine used to build Boost and B2-based projects. Reference for toolset, variant, -j, -… babelbabel transpiles modern JavaScript and JSX. Reference for --out-dir, --out-file, --config-file, --extensions,… bandit baselinebandit -b compares against a saved JSON baseline so only new findings fail the build. Reference for generatin… bandit -rbandit -r recursively scans Python source for common security issues and exits 1 on findings. Reference for -… bazel buildReference for bazel build in CI/CD: build targets and patterns hermetically, scope with target syntax, and ac… bazelbazel is a hermetic, cached build system. Reference for build, test, //..., --config, --remote_cache, --keep_… bazel queryReference for bazel query in CI/CD: inspect the dependency graph to find reverse deps, scope affected targets… bazel runReference for bazel run in CI/CD: build then execute a runnable target, pass program arguments after a separa… bazel testReference for bazel test in CI/CD: run test targets with caching, surface failing logs with --test_output=err… bazeliskReference for bazelisk in CI/CD: a version-pinning launcher that reads .bazelversion and downloads the matchi… bearbear intercepts a build to produce compile_commands.json for clang tooling. Reference for the -- separator, -… bombardierbombardier is a high-throughput HTTP benchmarking tool. Reference for -c, -n, -d, --rate, the latency output,… buck2 buildbuck2 build and buck2 test build and test targets by label. Reference for target patterns, --show-output, //.… buf breakingbuf breaking compares your proto against a baseline and fails on wire or source incompatibilities. Reference… buf buildbuf build compiles a module into a FileDescriptorSet image and surfaces compile errors early. Reference for -… buf formatbuf format rewrites .proto files into a canonical style and can fail CI on unformatted files. Reference for -… buf generatebuf generate runs configured plugins against a module using buf.gen.yaml. Reference for --template, remote pl… buf lintbuf lint checks .proto files against configurable rule sets like DEFAULT and STANDARD. Reference for the lint… buf pushbuf push uploads a proto module to the Buf Schema Registry (BSR) with optional labels. Reference for --label,… bundletool build-apksbundletool build-apks turns an .aab into an .apks set, and install-apks / --mode universal produce installabl… cargo addcargo add edits Cargo.toml to add a dependency, with --features, --dev, and --optional. Learn the syntax and… cargo auditcargo audit checks Cargo.lock against the RustSec advisory database and exits non-zero on findings. Reference… cargo auditcargo audit scans Cargo.lock for crates with known security advisories. Learn how to install it, ignore advis… cargo benchcargo bench builds and runs benchmarks in release mode. Learn filtering, --no-run, and why nightly or Criteri… cargo build --releasecargo build --release compiles with optimizations into target/release. Reference for --release, --locked, --t… cargo wasm32-unknowncargo build --target wasm32-unknown-unknown compiles Rust to browser wasm. Reference for the target, features… cargo wasm32-wasicargo build --target wasm32-wasip1 compiles Rust to a WASI module runnable in wasmtime. Reference for the tar… cargo buildWhat cargo build does, the flags you use most in CI (--release, --locked, --target), and how to fix the depen… cargo checkcargo check type-checks your crate without producing a binary, making it the fast CI gate. See usage, --works… cargo cleancargo clean removes the target directory to reclaim disk. Learn --release and -p for selective cleaning, and… cargo clippy --all-targetscargo clippy --all-targets --all-features -- -D warnings turns lints into a hard CI gate. Reference for the f… cargo clippy --fixcargo clippy --fix applies machine-applicable Clippy suggestions to your source. Reference for --allow-dirty,… cargo clippycargo clippy runs the Rust linter over your crate. Reference for --all-targets, --all-features, the -- separa… cargo clippycargo clippy runs the Rust linter. Learn how to deny warnings in CI with -D warnings, target specific lints,… cargocargo is the Rust build tool and package manager. Reference for build, test, --release, --locked, --all-featu… cargo deny checkcargo deny check lints dependencies for advisories, banned crates, license policy, and duplicate sources. Ref… cargo doc --no-depscargo doc --no-deps builds rustdoc HTML for your crates only. Reference for --no-deps, RUSTDOCFLAGS=-D warnin… cargo doccargo doc runs rustdoc to build a Rust crate's API docs. Reference for --no-deps, RUSTDOCFLAGS=-Dwarnings, an… cargo doccargo doc builds your crate documentation with rustdoc. Learn --no-deps, --open, and how to fail CI on broken… cargo fetchcargo fetch downloads all dependencies ahead of an offline build. Learn --locked and --target, and how it ena… cargo fmt --checkcargo fmt --all --check fails CI when code is not rustfmt-clean without modifying files. Reference for --chec… cargo fmtcargo fmt formats Rust with rustfmt. Learn the --check flag for CI, how to format the whole workspace, and ho… cargo generate-lockfilecargo generate-lockfile creates or updates Cargo.lock without building. Learn how it differs from cargo updat… cargo install --lockedcargo install --locked installs a CLI tool using its committed Cargo.lock for reproducibility. Reference for… cargo installcargo install builds and installs Rust binaries into ~/.cargo/bin. Learn --locked, --version, installing from… cargo llvm-covcargo llvm-cov produces source-based coverage using LLVM instrumentation. Reference for --lcov, --workspace,… cargo logincargo login stores a registry token for publishing. Learn the CI-safe alternative with CARGO_REGISTRY_TOKEN a… cargo metadatacargo metadata emits the resolved workspace graph as JSON for scripts and tools. Reference for --format-versi… cargo nextest --profile cicargo nextest run is a faster test runner with retries and JUnit output. Reference for --profile, --retries,… cargo packagecargo package builds a distributable .crate tarball and verifies it compiles. Learn --list, --no-verify, and… cargo publishcargo publish uploads a crate to crates.io. Learn --dry-run, --token for CI, and how to fix "already uploaded… cargo removecargo remove deletes a dependency from Cargo.toml. Learn the --dev and --build flags and how to fix "dependen… cargo runcargo run builds and runs a binary target. Learn how to pick a binary with --bin, pass program arguments afte… cargo test --workspacecargo test --workspace runs tests across all workspace members. Reference for --all-features, --no-fail-fast,… cargo testHow cargo test builds and runs unit, integration, and doc tests, the flags for filtering and CI, and the comm… cargo tree -icargo tree -i <crate> inverts the dependency tree to show what depends on a crate. Reference for -i, -d, -e f… cargo treecargo tree prints your dependency graph. Learn -i to find who pulls in a crate, -d for duplicates, and how to… cargo update --precisecargo update -p <crate> --precise <version> sets one dependency to an exact version in Cargo.lock. Reference… cargo updatecargo update changes Cargo.lock to newer dependency versions. Learn -p to update one crate, --precise to pin,… cargo vendorcargo vendor copies all dependencies into a local directory for offline, reproducible builds. Learn the confi… cargo vendorcargo vendor copies all dependencies into a local directory and prints a source-replacement config for offlin… cassowarycassowary run -u -c -n benchmarks an endpoint and can emit JSON for CI gates. Reference for the run flags, --… ccache -Mccache -M sets the maximum cache size so it does not grow without bound in CI. Reference for max_size, max_fi… ccache -sccache -s shows hit rate, misses, and cache size, the fastest way to prove caching works in CI. Reference for… ccache -z / -Cccache -z resets statistics and -C clears the cache. Reference for measuring per-run hit rates and forcing a… ccache compiler_checkccache compiler_check controls how the compiler is hashed into the cache key. Reference for content vs mtime… ccache CI cachePersisting CCACHE_DIR across CI runs is what makes ccache pay off. Reference for CCACHE_DIR, CCACHE_BASEDIR,… ccache basicsccache speeds rebuilds by caching compiler output keyed on inputs. Reference for wiring it into the compiler,… ccacheccache caches C/C++ compiler output to speed rebuilds. Reference for -s, max_size, CCACHE_DIR, and the zero-h… cfn-lintcfn-lint validates AWS CloudFormation templates against the resource specification and best-practice rules. R… check-jsonschema builtincheck-jsonschema ships built-in schemas for GitHub workflows, GitLab CI, Renovate and more. Reference for --b… check-jsonschemacheck-jsonschema validates JSON/YAML files against a JSON Schema, including GitHub workflows. Reference for -… checkov CI notecheckov scans IaC and exits non-zero on failed checks. Reference for --hard-fail-on, --compact, --quiet, and… clang wasm32-wasiwasi-sdk clang --target=wasm32-wasi compiles C/C++ to a WASI wasm module. Reference for --sysroot, -o, and th… clangclang is the LLVM C/C++ compiler. Reference for -c, -o, -I, -std, -fsanitize, -Weverything, and the diagnosti… clangclang is the LLVM C compiler. Reference for -c, -I, -fsanitize, -Weverything, and the "unknown argument" and… clang++clang++ is the LLVM C++ compiler. Reference for -std, -stdlib, -fsanitize, and the libc++-vs-libstdc++ link e… clippy lint levelsClippy lints take allow/warn/deny/forbid levels via attributes, -D/-A flags, and clippy.toml. Reference for #… cmake --build --presetbuildPresets and testPresets let CI build and test with one named command. Reference for cmake --build --pres… cmake --buildReference for cmake --build in CI/CD: drive any generator (Make or Ninja) through one portable command, selec… cmake --buildcmake --build <dir> compiles a configured project through whatever generator was chosen. Reference for --targ… cmake --installReference for cmake --install in CI/CD: stage built artifacts into a prefix or DESTDIR for packaging, with co… cmake --installcmake --install <dir> installs a built project to a prefix. Reference for --prefix, --config, --component, DE… cmake --presetcmake --preset reads CMakePresets.json for a named, reproducible configure. Reference for --preset, --list-pr… cmake -Dcmake -D<var>=<value> sets cache variables like CMAKE_BUILD_TYPE and CMAKE_INSTALL_PREFIX. Reference for comm… cmake -S -B -Gcmake -S <src> -B <build> -G <generator> configures a CMake project into a separate build directory. Referenc… cmake -D flagsThe -D cache flags that matter in CI: CMAKE_BUILD_TYPE, compiler launchers for ccache, EXPORT_COMPILE_COMMAND… cmakecmake configures and builds C/C++ projects. Reference for -S, -B, -G, -D, --build, --target, --preset, and th… cmake (configure)Reference for the cmake configure step in CI/CD: generate a build system out-of-source with -S/-B, pick a gen… CMake presetsReference for CMake presets in CI/CD: capture configure, build, and test settings in CMakePresets.json so loc… CMakePresets.jsonCMakePresets.json captures configure settings (generator, cache vars, env) so CI and developers use the same… componentize-jscomponentize-js turns a JavaScript module into a wasm component for a WIT world. Reference for the API/CLI, -… config-file-validatorconfig-file-validator (validator) recursively checks JSON, YAML, TOML, XML, INI and more for syntax validity.… conftest testconftest test evaluates YAML/JSON config against OPA Rego policies. Reference for --policy, --namespace, deny… conftest verifyconftest verify runs the unit tests for your Rego policies, and conftest pull fetches shared policy bundles.… protoc-gen-connect-goprotoc-gen-connect-go generates Connect RPC Go handlers that also speak gRPC and gRPC-Web. Reference for the… cpackcpack builds distributable packages (tarballs, DEB, RPM, NSIS) from a CMake project. Reference for -G, --conf… cpackcpack packages a CMake build into installers (DEB, RPM, TGZ, NSIS). Reference for -G, --config, and the "no i… csccsc is the C# compiler. Reference for /out, /target, /reference, /optimize, /langversion, /nowarn, and the C#… ctestctest runs tests registered by CMake. Reference for --output-on-failure, -j, --test-dir, -R, --rerun-failed,… ctestReference for ctest in CI/CD: run a CMake test suite, parallelize with -j, filter by name or label, and surfa… ctestctest is CMake’s test driver. Reference for -R, -j, --output-on-failure, -T, and the "No tests were found" CI… cue exportcue export evaluates CUE and emits concrete JSON or YAML config. Reference for --out, -e, -t, and the incompl… cue vetcue vet validates YAML/JSON data against a CUE schema and constraints. Reference for -d, -c, --strict, and th… datadog-ci junitdatadog-ci junit upload sends JUnit XML test reports to Datadog Test Visibility. Reference for --service, DD_… datadog-ci sourcemapsdatadog-ci sourcemaps upload sends JS source maps to Datadog so RUM error stack traces deminify. Reference fo… datadog-ci syntheticsdatadog-ci synthetics run-tests triggers Datadog Synthetic tests from CI and fails the build on failures. Ref… datree testdatree test scans Kubernetes manifests for misconfigurations and schema errors. Reference for --policy, --sch… cargo doc deployPublish target/doc from cargo doc to GitHub Pages with an index redirect. Reference for the redirect trick an… detect-secrets auditdetect-secrets audit walks each candidate in the baseline so you mark it a true or false positive. Reference… detect-secrets scandetect-secrets scan finds high-entropy strings and known secret patterns and writes a .secrets.baseline. Refe… detektdetekt runs static analysis on Kotlin code. Reference for --input, --config, --baseline, report formats, exit… docusaurus builddocusaurus build compiles a Docusaurus site to static files and fails on broken links by default. Reference f… docusaurus deploydocusaurus deploy builds and pushes a Docusaurus site to the gh-pages branch. Reference for GIT_USER, the con… dotnet -c ReleaseThe -c/--configuration flag selects Debug, Release, or a custom configuration. Reference for what changes, wh… dotnet add packagedotnet add package adds or updates a PackageReference. Reference for --version, --source, --no-restore, and t… dotnet builddotnet build compiles .NET projects. Reference for -c, -o, -f, --no-restore, -p:Property, --verbosity, and th… dotnet builddotnet build compiles a project or solution. Reference for -c, --no-restore, -warnaserror, and the MSB and NE… dotnet cleandotnet clean deletes the artifacts from a previous build. Reference for -c, -o, and why a stale bin/obj cause… dotnet ef migrationsdotnet ef migrations and database update apply EF Core schema changes. Reference for --project, --startup-pro… dotnet formatdotnet format applies or verifies code style and analyzer fixes. Reference for --verify-no-changes, --severit… dotnet list packagedotnet list package reports outdated, vulnerable, and deprecated NuGet packages. Reference for --vulnerable,… dotnet nuget localsdotnet nuget locals lists and clears NuGet caches (global-packages, http-cache, temp). Reference for --clear,… dotnet nuget pushdotnet nuget push uploads a .nupkg to a NuGet feed. Reference for --api-key, --source, --skip-duplicate, and… dotnet packdotnet pack creates a .nupkg from a project. Reference for -c, -p:Version, --include-symbols, -o, and the NU5… dotnet publish self-containeddotnet publish --self-contained -r bundles the .NET runtime for a target RID. Reference for runtime identifie… dotnet publish AOTNative AOT compiles a .NET app to a self-contained native binary. Reference for PublishAot, -r, the toolchain… dotnet publishdotnet publish compiles and lays out an app for deployment. Reference for -c, -r, --self-contained, -o, and t… dotnet restore --locked-modedotnet restore --locked-mode fails if packages.lock.json is out of date. Reference for lock files, RestorePac… dotnet restoredotnet restore downloads the NuGet packages a project depends on. Reference for --packages, --locked-mode, so… dotnet rundotnet run builds and runs a project in one step. Reference for --project, --no-build, passing args after --,… dotnet slndotnet sln adds, removes, and lists projects in a .sln. Reference for add, remove, list, and the project-path… dotnet test coveragedotnet test --collect "XPlat Code Coverage" gathers coverage with coverlet. Reference for the collector, --re… dotnet test --filterdotnet test --filter runs a subset of tests by name, trait, or category. Reference for the filter expression… dotnet testdotnet test discovers and runs tests in a project or solution. Reference for --no-build, --logger, -c, and th… dotnet tool installdotnet tool install adds a .NET global or local tool. Reference for --global, --tool-path, --version, and the… dotnet tool restoredotnet tool restore installs the tools pinned in the local manifest. Reference for the manifest, --configfile… dotnet vstestdotnet vstest runs already-built test DLLs directly. Reference for --TestCaseFilter, --logger, --Settings, an… dotnet watchdotnet watch reruns a command when source files change. Reference for watch run/test, --no-hot-reload, and wh… doxygendoxygen generates API documentation from annotated C, C++, and other sources. Reference for the Doxyfile, WAR… dpkg-buildpackagedpkg-buildpackage builds a Debian .deb from a debian/ source tree. Reference for -us -uc -b, and the "unmet b… drilldrill runs HTTP load-test plans defined in YAML with iterations and concurrency. Reference for the benchmark… dyff betweendyff between produces a human-readable structural diff of two YAML/JSON files, ideal for GitOps drift. Refere… eas build / submiteas build compiles Expo apps in the cloud (or locally) and eas submit uploads to the stores. Reference for --… emccemcc (Emscripten) compiles C/C++ to wasm plus JS glue. Reference for -o, -s flags, -O, and the emsdk-related… emulator (headless)The emulator command boots an AVD; in CI you run it headless with -no-window -no-audio. Reference for the acc… esbuildesbuild is a fast Go-based bundler/compiler. Reference for --bundle, --outfile, --minify, --platform, --targe… flutter buildflutter build compiles release artifacts: apk, appbundle, ios, ipa. Reference for --release, --flavor, --dart… flutter test / doctorflutter test runs the Dart/widget test suite and flutter doctor verifies the toolchain. Reference for --cover… fortio loadfortio load -qps -c -t runs a controlled QPS load test and can fail on a percentile target. Reference for the… fortio serverfortio server hosts a UI and echo endpoints; fortio report renders saved JSON histograms. Reference for -ui-p… g++g++ is the GNU C++ compiler driver. Reference for -std, -c, -l, -pthread, and the "undefined reference to vta… Gatling runGatling runs a Scala/Java/Kotlin simulation and fails the build when its assertions are not met. Reference fo… gccgcc is the GNU C compiler driver. Reference for -c, -o, -I, -L, -l, -Wall, -O2, -std, and the header/library… gccgcc is the GNU C compiler driver. Reference for -c, -o, -I, -L, -l, -Wall, -O2, and the "fatal error: X.h: No… gdbgdb is the GNU debugger. Reference for --batch, -ex, bt, core files, and the "ptrace: Operation not permitted… ghz reportsghz can emit JSON, HTML, or CSV reports and gate CI on latency. Reference for -O, -o, parsing the JSON, and a… ghz load testghz drives load against a gRPC method with -c concurrency and -n request count. Reference for --insecure, --c… gitleaks baselinegitleaks --baseline-path suppresses findings already present in a saved report so only new leaks fail the bui… gitleaks configThe .gitleaks.toml config defines custom rules and allowlists to cut false positives. Reference for [[rules]]… gitleaks detectgitleaks detect scans the full git history (or a commit range) for hardcoded secrets and exits non-zero on a… gitleaks SARIFgitleaks --report-format sarif writes a SARIF file you can upload to GitHub code scanning. Reference for the… go build -ldflagsgo build -ldflags injects build metadata and strips binaries. Reference for -X, -s -w, -trimpath, and the lin… go build -tagsgo build -tags selects files guarded by //go:build constraints. Reference for -tags, comma vs space syntax, a… go buildgo build compiles Go packages. Reference for -o, -ldflags, -tags, -race, GOOS/GOARCH cross-compilation, and t… go buildgo build compiles Go packages and binaries. Learn -o, ./..., cross-compiling with GOOS/GOARCH, and how to fix… go cleango clean removes build artifacts and can clear the build and module caches. Learn -cache, -modcache, -testcac… go doc / pkgsitego doc prints package docs in the terminal; pkgsite serves the modern docs site locally. Reference for both,… go docgo doc prints documentation for a package, symbol, or method from the command line. Learn -all and -src, and… go envgo env prints and sets Go environment variables like GOOS, GOPATH, GOPROXY, and GOFLAGS. Learn go env -w and… go fmtgo fmt formats Go source with gofmt. Learn how to gate CI on formatting with gofmt -l and why go fmt rewrites… go generatego generate runs the commands in //go:generate directives. Reference for -run, -x, the git-diff drift gate, a… go generatego generate runs code generators declared in //go:generate directives. Learn how it works, what it does not d… go getgo get adds or updates a module dependency in go.mod. Learn version selectors, @latest vs @none, and why go g… go install pkg@versiongo install pkg@version builds and installs a tool binary at an exact version into GOBIN. Reference for the @v… go installgo install compiles and installs a binary into GOBIN. Learn the @version syntax for tools, where binaries lan… go list -jsongo list reports packages and modules as text or JSON for scripts. Reference for -json, -m, -deps, -f template… go listgo list reports information about packages and modules. Learn -m, -json, -f templates, and how to enumerate p… go mod downloadgo mod download fetches modules into the cache before building. Reference for -x, -json, GOFLAGS=-mod=readonl… go mod downloadgo mod download fetches module dependencies into the module cache. Learn how it speeds up CI, the -x flag, an… go mod initgo mod init creates a new go.mod with your module path. Learn how to choose the right module path and fix the… go mod tidygo mod tidy adds missing and removes unused module requirements. Reference for -go, -compat, the git-diff CI… go mod tidygo mod tidy adds missing and removes unused dependencies in go.mod and go.sum. Learn the -go flag and how to… go mod vendorgo mod vendor copies dependencies into a vendor/ directory for offline builds. Learn -mod=vendor and how to f… go mod verifygo mod verify checks that the modules in your cache match the checksums in go.sum. Learn what it guarantees a… go rungo run compiles and runs a Go program without leaving a binary. Learn the . vs ./cmd/x syntax, passing args,… go test -benchgo test -bench runs Go benchmarks with allocation and memory stats. Reference for -bench, -benchmem, -benchti… go test -coverprofilego test -coverprofile writes a coverage profile you can render or gate on. Reference for -covermode, -coverpk… go test -rungo test -run selects tests by regular expression; -count=1 bypasses the cache. Reference for -run, -count, -v… go testgo test builds and runs Go tests. Learn -run, -race, -cover, -count=1 to bypass the cache, and how to fix fla… go tool pprofgo tool pprof analyzes CPU and memory profiles produced by tests or running services. Reference for -top, -li… go toolgo tool runs the bundled Go tools - pprof, cover, trace, objdump. Learn how to view coverage and profiles, an… go versiongo version prints the Go toolchain version and can report the version a binary was built with. Learn -m for m… go vetgo vet reports suspicious Go constructs. Reference for ./..., -vettool, and the printf/struct-tag/lock-copy i… go vetgo vet reports suspicious constructs the compiler accepts. Reference for enabling/disabling analyzers (-print… go vetgo vet reports suspicious constructs that compile but are likely bugs. Learn how to vet all packages and fix… go work usego work init and go work use set up a go.work file spanning multiple modules. Reference for the subcommands,… go workgo work manages multi-module workspaces with a go.work file. Learn go work init, go work use, and whether to… goenvgoenv manages Go versions via shims and .go-version, the rbenv model. Reference for install, local/global, GO… golangci-lint configgolangci-lint reads .golangci.yml for linters, exclusions, and settings. Reference for the run/linters/issues… golangci-lint rungolangci-lint run executes many Go linters in one pass. Reference for path patterns, ./... , --new-from-rev,… golangci-lint annotationsgolangci-lint --out-format github-actions emits ::error:: annotations that show inline on PRs. Reference for… goosegoose is a Rust load-test framework run as a compiled binary with -u, -r, -t and coordinated-omission handlin… govulncheckgovulncheck reports Go vulnerabilities and, by analyzing call paths, focuses on ones your code actually reach… gradle --build-cacheThe Gradle --build-cache flag reuses outputs of cacheable tasks across builds and machines. Reference for ena… gradle --build-cacheWhat --build-cache does - lets Gradle reuse task outputs from a local or remote cache to skip work - how to e… gradle config cacheThe Gradle --configuration-cache flag caches the configured task graph to skip the configuration phase. Refer… gradle --continueThe Gradle --continue flag keeps building after a task fails so you see all failures in one run. Reference fo… gradle --no-daemonThe Gradle --no-daemon flag runs the build in a single-use JVM that exits when done. Reference for why CI use… gradle --offlineThe Gradle --offline flag forces builds to use only the local dependency cache. Reference for hermetic CI, pr… gradle --offlineWhat gradle --offline does - runs the build using only cached dependencies with no network - and how to warm… gradle --parallelThe Gradle --parallel flag executes independent subprojects concurrently. Reference for --max-workers, when i… gradle --refresh-dependenciesWhat --refresh-dependencies does - forces Gradle to re-resolve and re-download all dependencies, ignoring cac… gradle assembleThe Gradle assemble task builds all outputs (jars, wars) without running tests or checks. Reference for when… gradle assembleWhat gradle assemble does - produces the project’s output artifacts (jar, war) without running tests or check… gradle bootRunWhat gradle bootRun does - runs your Spring Boot app from source via the Spring Boot Gradle plugin - with pro… gradle buildThe Gradle build task assembles and tests the project: it depends on assemble plus check. Reference for what… gradle buildWhat gradle build does - assembles and tests the project by running the assemble and check tasks - with CI us… gradle checkThe Gradle check task aggregates every verification task: test, plus linters and code-quality plugins. Refere… gradle checkWhat gradle check does - runs all verification tasks including test and code-quality plugins, without produci… gradle cleanWhat gradle clean does - deletes the project build/ directory - when it actually helps in CI, and why overusi… gradlegradle is the JVM build tool. Reference for build, test, --no-daemon, --build-cache, -x, --stacktrace, and th… gradle dependenciesThe Gradle dependencies task prints the resolved dependency tree per configuration. Reference for --configura… gradle dependenciesWhat gradle dependencies does - prints the resolved dependency tree per configuration so you can find version… gradle dependencyInsightWhat gradle dependencyInsight does - explains why a dependency resolved to the version it did and which paths… gradle dependencyInsightThe Gradle dependencyInsight task explains why a specific dependency resolved to its version. Reference for -… gradle initWhat gradle init does - scaffolds a new Gradle project or converts a Maven build, generating build scripts an… gradle jarWhat the gradle jar task does - assembles a JAR of the main classes and resources - and why a plain jar may n… gradle javadocWhat the gradle javadoc task does - generates API docs for the main source set - and how to stop strict docli… gradle propertiesWhat gradle properties does - prints the project’s configured properties (version, group, project props) - so… gradle publishWhat gradle publish does - uploads your artifacts to the repositories defined by the maven-publish plugin - w… gradle tasksWhat gradle tasks does - lists the tasks available in the build, grouped by category - and how to use --all a… gradle testThe Gradle test task runs unit tests via the configured framework. Reference for --tests filtering, --fail-fa… gradle testWhat the gradle test task does - runs unit tests and writes HTML/JUnit reports - with filtering and the up-to… gradle wrapperThe Gradle wrapper task generates or updates gradlew and pins the Gradle version. Reference for --gradle-vers… gradle wrapperWhat gradle wrapper does - generates or updates the Gradle Wrapper (gradlew and gradle-wrapper.properties) th… gradlew (Android)The Gradle wrapper runs Android tasks: assembleRelease, bundleRelease, test, lint. Reference for the key task… grafana-cli pluginsgrafana-cli plugins install adds Grafana plugins when building images or provisioning. Reference for the comm… grpc_health_probegrpc_health_probe checks the standard gRPC Health service and exits with a status code. Reference for -addr,… grpcurl listgrpcurl list and describe enumerate gRPC services and methods via reflection. Reference for list, describe, a… grpcurl callgrpcurl invokes a gRPC method like curl for HTTP, with -d JSON and -plaintext. Reference for the request flag… grpcurl reflection vs protogrpcurl can resolve schemas via server reflection or from local .proto/protoset files. Reference for -proto,… h2loadh2load (from nghttp2) benchmarks HTTP/1.1, HTTP/2, and HTTP/3 with -n -c -m. Reference for the stream flag, T… hadolint confighadolint reads .hadolint.yaml for ignored rules, severity overrides, and label schemas. Reference for the con… hadolint ignorehadolint ignores rules via --ignore, inline # hadolint ignore comments, and the config file. Reference for DL… hadolinthadolint lints Dockerfiles for best-practice and embedded ShellCheck issues. Reference for passing the Docker… heyhey sends a burst of concurrent HTTP requests and prints a latency distribution. Reference for -n, -c, -z, cu… hugo --minifyhugo builds a static site (often docs via Docsy or Doks); --minify shrinks output. Reference for the flags an… jarsignerjarsigner signs JARs and (v1 scheme) APKs with a keystore and verifies them. Reference for -keystore, -storep… javajava launches the JVM to run classes and JARs. Reference for -jar, -cp, --module-path, -D system properties,… javacjavac is the Java compiler. Reference for -d, -cp/-classpath, --release, -source/-target, -Xlint, and the pac… javadocjavadoc generates HTML API docs from Java source and doc comments. Reference for -d, -sourcepath, -Xdoclint,… jco transpilejco transpile converts a wasm component into runnable ES modules for JS hosts. Reference for transpile, compo… jenvjenv switches between already-installed JDKs via shims. Reference for jenv add, local/global, the init eval,… jsdocjsdoc generates HTML API docs from JavaScript source and JSDoc comments. Reference for -c, -d, -r, and the co… jsonlintjsonlint validates JSON syntax and can pretty-print or check formatting. Reference for -q, -c, -i, and the pa… jsonnetjsonnet evaluates a .jsonnet template into JSON config for Kubernetes and more. Reference for --ext-str, --tl… jsonnetfmtjsonnetfmt formats Jsonnet source to a canonical style with a --test check mode for CI. Reference for -i, --t… just in CIRunning just in CI means installing the binary and invoking recipes as pipeline steps. Reference for install… just set shelljust runs recipe lines in sh by default; set shell changes that to bash or another interpreter. Reference for… just recipesjust runs recipes defined in a justfile, a command runner inspired by make. Reference for recipe syntax, runn… just dotenvjust loads variables from a .env file when set dotenv-load is enabled. Reference for dotenv-load, dotenv-file… just dependenciesjust recipes can depend on other recipes that run first. Reference for prior and after dependencies, passing… just parametersjust recipes accept positional parameters, defaults, and variadic arguments. Reference for parameter syntax,… just shebang recipesjust shebang recipes run the whole body as one script in another language. Reference for shebang syntax, set… just variablesjust supports variables with := assignments and interpolation with {{ }}. Reference for variable syntax, envi… k6 --outk6 --out streams run metrics to JSON, CSV, or a backend like InfluxDB or Prometheus remote write. Reference f… k6 runk6 run executes a JavaScript load-test script with virtual users and a duration. Reference for --vus, --durat… k6 thresholdsk6 thresholds turn pass/fail SLOs (p95 latency, error rate) into a non-zero exit code. Reference for the thre… keytool (keystore)keytool -genkeypair creates the JKS/PKCS12 keystore that signs Android apps. Reference for -alias, -storepass… kotlinckotlinc is the Kotlin compiler. Reference for -include-runtime, -d, -classpath, -jvm-target, -Werror, and the… ktlintktlint checks Kotlin style and formats code. Reference for glob args, --format, --reporter, exit codes, .edit… ldld is the GNU linker. Reference for -o, -l, -L, -shared, -rpath, --gc-sections, and the undefined-reference a… ldld is the GNU linker. Reference for -o, -l, -L, -rpath, --start-group, and the "undefined reference" and "can… lddldd prints the shared libraries a binary needs. Reference for -v, -u, -d, -r, and how to debug "not found" li… lhci assertlhci assert evaluates Lighthouse results against thresholds and presets, failing CI on regressions. Reference… lhci autorunlhci autorun runs collect, assert, and upload in one step for Lighthouse CI. Reference for lighthouserc confi… libtoollibtool abstracts shared-library creation across platforms. Reference for libtoolize, .la files, and the "can… lld (LLVM linker)lld is the fast LLVM linker. Reference for -fuse-ld=lld, --threads, and the "unknown argument" and missing-bi… lldblldb is the LLVM debugger. Reference for --batch, -o, bt all, core files, and the developer-mode and ptrace p… locust --headlesslocust --headless -u -r --run-time runs a Python-defined load test without the web UI. Reference for the flag… locust distributedlocust --master and --worker spread generated load across processes so one CPU is not the bottleneck. Referen… ltraceltrace traces library (and optionally system) calls. Reference for -f, -e, -S, and the ptrace-permission and… luacheckluacheck statically analyzes Lua for undefined globals and unused variables. Reference for paths, --std, --gl… Mage in CIRunning Mage in CI means installing it (or using go run) and invoking targets as steps. Reference for install… Mage targetsMage defines build targets as exported Go functions in a magefile. Reference for target signatures, mg.Deps,… make -CReference for make -C in CI/CD: change into a directory before reading its Makefile, the clean way to build a… make -jReference for make -j in CI/CD: run recipes in parallel, size jobs to runner cores and memory, and avoid the… make -jmake -j builds in parallel and -C changes directory. Reference for GNU Make flags, targets, and the "No rule… makeReference for make in CI/CD: how make reads a Makefile, builds the default or a named target, and which envir… makemake runs builds from a Makefile. Reference for -j, -C, -f, -B, -k, VAR=value overrides, and the Makefile err… make installmake install copies built artifacts to the prefix; DESTDIR stages them elsewhere. Reference for install targe… make targetsReference for make targets in CI/CD: what a target is, how to run several in one invocation, and how to disco… Makefile .PHONYReference for Makefile .PHONY in CI/CD: declare task targets that are not files so make always runs them, eve… makepkgmakepkg builds Arch Linux packages from a PKGBUILD. Reference for -s, -f, --noconfirm, and the "cannot run as… markdownlintmarkdownlint-cli checks Markdown against MD-rule conventions. Reference for globs, --fix, --config, --ignore,… mdbook buildmdbook build renders a book of Markdown into a static HTML site. Reference for --dest-dir, mdbook test, and t… meson --cross-filemeson --cross-file points setup at a cross toolchain definition for cross-compiling. Reference for the cross… meson compilemeson compile -C <builddir> builds a configured Meson project without calling ninja directly. Reference for -… meson compilemeson compile builds a configured Meson project without calling ninja directly. Reference for -C, -j, --verbo… meson configuremeson configure views and changes options of an existing build dir; --reconfigure and --wipe reset it. Refere… meson introspectmeson introspect emits JSON about targets, tests, dependencies, and options. Reference for --targets, --tests… meson setupmeson setup configures a separate build directory from the source tree. Reference for buildtype, -D options,… meson setupmeson setup <builddir> configures a Meson project. Reference for --buildtype, -D options, --prefix, cross fil… meson testmeson test -C <builddir> runs a project test suite. Reference for --print-errorlogs, --suite, --num-processes… meson testmeson test runs a project test suite with parallelism, timeouts, and log output. Reference for --print-errorl… meson wrapmeson wrap and subprojects fetch and build dependencies from .wrap files. Reference for wrap install, --wrap-… mesonmeson is a fast build system that configures then drives ninja. Reference for setup, compile, --buildtype, an… mise in CIRunning mise in CI means installing it, then using mise exec or activation so tools are on PATH. Reference fo… mise installmise install provisions the tool versions pinned in mise.toml or .tool-versions. Reference for install, the c… mise runmise run executes tasks defined in mise.toml or task files, with deps and sources. Reference for [tasks], mis… mise usemise use adds or updates a tool version in mise.toml and installs it. Reference for mise use, --global, --pin… mise envmise sets environment variables per directory via [env] and loads .env files. Reference for [env], mise env,… mkdocs buildmkdocs build renders a MkDocs site to static HTML; --strict turns warnings into a non-zero exit. Reference fo… mkdocs gh-deploymkdocs gh-deploy builds the site and pushes it to the gh-pages branch. Reference for the flags, the force/dir… mvn --settingsThe Maven --settings (-s) flag points Maven at a specific settings.xml for repos and credentials. Reference f… mvn -BThe Maven -B (--batch-mode) flag runs non-interactively with plain output, ideal for CI. Reference for -ntp,… mvn -DskipTestsHow -DskipTests and -Dmaven.test.skip differ - one skips running tests, the other skips compiling them too -… mvn -faeThe Maven -fae (--fail-at-end) flag keeps building unaffected modules after a failure and reports all failure… mvn -o (offline)What mvn -o / --offline does - builds using only the local ~/.m2 repository with no network - and how to pre-… mvn -PThe Maven -P flag activates named profiles from the pom or settings.xml. Reference for syntax, deactivation w… mvn -TThe Maven -T flag builds reactor modules in parallel using a thread count or per-core multiplier. Reference f… mvn -U (update snapshots)What mvn -U / --update-snapshots does - forces Maven to re-check remote repos for updated SNAPSHOTs and missi… mvn cleanThe Maven clean phase deletes the build output (target/) via the clean plugin. Reference for combining it wit… mvn cleanWhat mvn clean does - deletes the target/ directory from previous builds via the clean lifecycle - and when t… mvnmvn is the Maven build tool. Reference for clean, install, verify, -B, -DskipTests, -P, -pl, and the Maven CI… mvn compileWhat mvn compile does - compiles main source code via the maven-compiler-plugin - plus CI usage, the release/… mvn go-offlineThe Maven dependency:go-offline goal downloads all dependencies and plugins so later builds can run with -o.… dependency:purge-local-repositoryWhat dependency:purge-local-repository does - removes a project’s artifacts from ~/.m2 and re-resolves them -… mvn dependency:resolveWhat dependency:resolve does - downloads and lists all dependencies a project needs - and how to use it to pr… mvn dependency:treeThe Maven dependency:tree goal prints the resolved dependency graph with omitted-for-conflict notes. Referenc… mvn dependency:treeWhat dependency:tree does - prints the full transitive dependency graph so you can find version conflicts and… mvn deployThe Maven deploy phase uploads the built artifact to a remote repository defined in distributionManagement. R… mvn deployWhat mvn deploy does - uploads your built artifact to a remote repository (Nexus, Artifactory, Central) - wit… mvn help:effective-pomWhat help:effective-pom does - prints the fully resolved POM after inheritance, profiles, and defaults merge… mvn installThe Maven install phase builds and copies the artifact into ~/.m2 so other local modules can use it. Referenc… mvn installWhat mvn install does - installs the built artifact into your local ~/.m2 repository for other local projects… mvn packageThe Maven package phase compiles, tests, and packages the project into a jar or war. Reference for what runs… mvn packageWhat mvn package does - compiles, tests, and bundles your code into a JAR or WAR in target/ - with CI usage,… mvn release:prepareWhat release:prepare does - sets the release version, tags the SCM, and bumps to the next SNAPSHOT via the ma… mvn siteWhat mvn site does - generates a project documentation and report website via the maven-site-plugin - with CI… mvn spring-boot:runWhat spring-boot:run does - compiles and runs your Spring Boot app via the spring-boot-maven-plugin - with pr… mvn surefire:testThe Maven surefire test goal runs unit tests. Reference for -Dtest filtering, -DfailIfNoTests, the difference… mvn surefire:testWhat surefire:test does - the goal that runs unit tests in the Maven test phase - with forking, parallelism,… mvn testWhat mvn test does - compiles and runs unit tests with Surefire - plus how to filter tests, skip them correct… mvn validateWhat mvn validate does - the first Maven lifecycle phase, checking the POM is correct and all needed informat… mvn verifyThe Maven verify phase runs integration tests and checks via failsafe after packaging. Reference for failsafe… mvn verifyWhat mvn verify does - runs integration tests and quality checks after packaging via Failsafe - and why CI pi… newrelic-cli deploymentnewrelic-cli apm deployment create records a change-tracking deployment marker in New Relic from CI. Referenc… ninja -jninja parallelizes builds automatically; -j and -l tune it. Reference for setting job count and load limits t… ninja -t cleanninja -t clean removes build outputs without deleting the configured build dir. Reference for clean, -g, and… ninja -t toolsninja -t targets, -t graph, and -t commands inspect what the build will do. Reference for listing targets and… ninja -tninja -t exposes subtools like clean, graph, compdb, deps, and targets. Reference for inspecting and cleaning… ninja -vninja -v prints the full command line for every job, essential for debugging include paths and flags in CI. R… ninjaninja is a small, fast build system. Reference for -j, -C, -f, -t, -k, -v, and the ninja CI errors you will s… ninja <target>ninja builds the default or a named target from build.ninja. Reference for naming targets, -C to change direc… ninjaninja is a small, fast build system that CMake and Meson generate. Reference for -j, -C, targets, and the bui… ninjaninja is a fast build backend driven by generated build.ninja files. Reference for -j, -t, -v, and the "no su… nmnm lists the symbols in object files and libraries. Reference for -C, -D, -g, -u, and using it to debug "unde… npm audit levelnpm audit --audit-level sets the minimum severity that makes the command exit non-zero. Reference for --audit… npm audit fixnpm audit fix upgrades vulnerable dependencies within semver, and --force allows breaking bumps. Reference fo… nvccnvcc is the CUDA compiler driver. Reference for -o, -arch, -gencode, -c, -I, -O, and the CUDA build errors th… objcopyobjcopy copies and transforms object files. Reference for --only-keep-debug, --add-gnu-debuglink, -O binary,… objdumpobjdump disassembles and inspects object files. Reference for -d, -t, -h, -T, -C, and using it to debug archi… ohaoha is a Rust HTTP load generator with a live histogram and clean summaries. Reference for -n, -c, -z, --no-t… opa evalopa eval evaluates a Rego query against input and data, with --fail to gate CI. Reference for -i, -d, --forma… opa fmtopa fmt formats Rego to a canonical style and, with --fail, gates CI on unformatted files. Reference for --li… opa testopa test runs Rego test_ rules with coverage and verbose output. Reference for --coverage, --threshold, -v, a… openapi-generator-cliopenapi-generator-cli generate produces clients and servers from an OpenAPI spec. Reference for -g, -i, -o, -… openapi-generatoropenapi-generator-cli generate produces HTML docs (and clients) from an OpenAPI spec. Reference for -g, -i, -… osv-scanner SARIFosv-scanner --format sarif writes SARIF for GitHub code scanning, and osv-scanner.toml ignores triaged adviso… osv-scanner lockfileosv-scanner checks lockfiles and directories against the OSV.dev vulnerability database and exits non-zero on… otelcol validateotelcol validate parses an OpenTelemetry Collector config and exits non-zero on errors without starting the c… pandoc PDFpandoc builds PDFs from Markdown via a PDF engine like pdflatex. Reference for --pdf-engine, and the pdflatex… pandocpandoc converts documents between Markdown, HTML, DOCX, and more. Reference for -o, -f/-t, --standalone, --to… patchelfpatchelf edits ELF interpreter and RPATH after linking. Reference for --set-rpath, --set-interpreter, and the… perf (Linux)perf profiles CPU performance with hardware counters. Reference for stat, record, report, and the "perf_event… pip-audit --fixpip-audit --fix upgrades vulnerable Python packages to a patched version, optionally in a requirements file w… pip-auditpip-audit checks the installed environment or a requirements file against PyPI advisories and exits non-zero… PKG_CONFIG_PATHPKG_CONFIG_PATH and PKG_CONFIG_LIBDIR tell pkg-config where to find .pc files. Reference for custom prefixes,… pkg-config --cflags --libspkg-config emits the include and link flags for a library from its .pc file. Reference for --cflags, --libs,… pkg-configpkg-config emits the compile and link flags for installed libraries. Reference for --cflags, --libs, --exists… pkg-config --existspkg-config --exists and --atleast-version test for a library and version by exit code. Reference for scriptin… pkg-configpkg-config emits compile and link flags for installed libraries. Reference for --cflags, --libs, PKG_CONFIG_P… plowplow is a Go HTTP benchmarker with a live terminal dashboard. Reference for -c, -n, -d, --rate, and the CI er… pod installpod install resolves and installs CocoaPods dependencies for iOS. Reference for install vs update, repo updat… premake5premake5 turns a premake5.lua script into Makefiles or IDE project files. Reference for action targets like g… promtool check configpromtool check config validates a Prometheus configuration file and the rule files it references. Reference f… promtool check rulespromtool check rules validates Prometheus recording and alerting rule files before they ship. Reference for t… promtool test rulespromtool test rules runs unit tests for Prometheus recording and alerting rules using sample series. Referenc… protocprotoc is the Protocol Buffers compiler. Reference for --proto_path, --go_out, --plugin, --descriptor_set_out… protoc well-known typesprotoc resolves well-known types like Timestamp and Empty from google/protobuf/*.proto. Reference for finding… protoc-gen-go-grpcprotoc-gen-go-grpc generates Go gRPC server and client stubs via --go-grpc_out. Reference for install, requir… protoc-gen-goprotoc-gen-go is the protoc plugin that generates Go structs from messages. Reference for installing it, --go… protoc generateprotoc compiles .proto files into language code via -I and --<lang>_out. Reference for the import path, outpu… protolintprotolint lints .proto files against pluggable rules and can auto-fix with -fix. Reference for lint, -config_… prototoolprototool lints, formats, and compiles .proto via prototool.yaml. Reference for lint, format, compile, and mi… ranlibranlib generates the symbol index inside a static library. Reference for its use, the ar s equivalence, and t… rbenv localrbenv install builds Ruby via ruby-build and rbenv local pins it per project. Reference for the commands, shi… Read the Docs / PagesHow Read the Docs builds Sphinx/MkDocs projects and how that compares to self-publishing to GitHub Pages. Ref… readelfreadelf inspects ELF object and binary internals. Reference for -h, -d, -a, -s, and using it to debug RPATH,… redocly build-docsredocly build-docs renders an OpenAPI spec into a standalone API reference; redocly lint validates it. Refere… remarshalremarshal converts config between TOML, YAML and JSON losslessly. Reference for toml2json/yaml2json helpers,… rolluprollup bundles ES modules into optimized output. Reference for -c, -i, -o, --format, --sourcemap, --watch, an… rpmbuildrpmbuild builds .rpm packages from a .spec file. Reference for -bb, -ba, --define, and the "Installed but unp… rubocop todo filerubocop --auto-gen-config generates .rubocop_todo.yml to grandfather existing offenses. Reference for adoptin… rubocop -Arubocop -a and -A autocorrect offenses, safe and unsafe. Reference for the difference between -a and -A, --au… rubocop configrubocop reads .rubocop.yml for cop settings, AllCops, and inheritance. Reference for TargetRubyVersion, Inclu… rubocoprubocop lints and formats Ruby against a configurable cop set. Reference for path args, --parallel, --only/--… rustcrustc is the Rust compiler. Reference for -O, --edition, --crate-type, -C opt-level, --emit, and the E04xx er… rustup toolchainrustup manages Rust toolchains, components (clippy, rustfmt), and cross targets. Reference for toolchain inst… rustup defaultrustup default and overrides select which Rust toolchain CI uses. Reference for default, override set, rust-t… scalacscalac is the Scala compiler. Reference for -d, -classpath, -deprecation, -Xfatal-warnings, -release, and the… sccache --show-statssccache --show-stats reports requests, hits, misses, and the active backend. Reference for confirming caching… sccache GHA cachesccache can use the GitHub Actions cache as its backend with SCCACHE_GHA_ENABLED. Reference for the env vars… sccache S3 / Redissccache can store its cache in S3-compatible object storage or Redis for a team-shared cache. Reference for t… sccache basicssccache caches C/C++/Rust/CUDA compilations with local, cloud, or distributed storage. Reference for wiring i… sccachesccache is a compiler cache with cloud (S3/GCS) backends. Reference for --show-stats, SCCACHE_DIR, SCCACHE_BU… sconsscons builds projects described in an SConstruct Python script. Reference for -j, targets, -C, variables, and… SDKMAN! in CISDKMAN! manages JVM SDKs (Java, Gradle, Maven, Kotlin). Reference for sdk install non-interactively, sourcing… sdkmanager --licensessdkmanager --licenses accepts the Android SDK license agreements non-interactively. Reference for the yes-pip… sdkmanager installsdkmanager installs and updates Android SDK components (platforms, build-tools, emulator). Reference for pack… semgrep SARIFsemgrep --sarif --output writes SARIF for GitHub code scanning. Reference for the flags, the upload-sarif ste… semgrep cisemgrep ci is the purpose-built CI command that detects the diff, applies baselines, and reports to Semgrep A… semgrep scansemgrep scan runs static analysis rules over your code and exits non-zero on findings or errors. Reference fo… sentry-cli releasessentry-cli releases new creates a release and finalize closes it, tying deploys to errors. Reference for the… sentry-cli set-commitssentry-cli releases set-commits associates git commits with a release so Sentry can flag suspect commits. Ref… sentry-cli sourcemapssentry-cli sourcemaps upload sends JS source maps to a Sentry release so production stack traces unminify. Re… shellcheck severityshellcheck --severity sets the minimum level reported, from style up to error. Reference for the four levels,… shellcheck excludeshellcheck silences specific SC codes via --exclude, .shellcheckrc disable, and inline directives. Reference… shellcheckshellcheck statically analyzes bash and sh scripts for bugs. Reference for passing files, --shell, --enable o… siegesiege load-tests with -c concurrent users for -t time, optionally cycling a urls file. Reference for -c, -t,… snyk SARIFsnyk test and snyk code test write SARIF via --sarif-file-output for GitHub code scanning. Reference for the… snyk testsnyk test scans a project manifest for known-vulnerable dependencies and exits 1 on findings. Reference for -… spectral lintspectral lint checks OpenAPI and AsyncAPI documents against rules and exits non-zero on errors. Reference for… spectral rulesetspectral rulesets extend spectral:oas with custom rules using given/then and functions. Reference for the rul… sphinx-autobuildsphinx-autobuild watches Sphinx sources and rebuilds on change with live reload. Reference for its flags and… sphinx-build htmlsphinx-build -b html renders a Sphinx project to HTML. Reference for the builder flag, source/out dirs, -W fa… sphinx linkchecksphinx-build -b linkcheck crawls every external URL in a Sphinx project and reports broken ones. Reference fo… spin buildThe Fermyon spin CLI builds and runs wasm serverless apps. Reference for spin build, spin up, --listen, and t… stracestrace traces system calls and signals. Reference for -f, -e, -p, -o, and the "ptrace: Operation not permitte… stripstrip removes symbols and debug info to shrink binaries. Reference for -s, -g, --strip-unneeded, and the "los… stylelint --fixstylelint --fix rewrites stylesheets to satisfy auto-fixable rules. Reference for what --fix can and cannot c… stylelint configstylelint reads .stylelintrc with rules, extends, and plugins. Reference for stylelint-config-standard, rule… stylelintstylelint lints CSS, SCSS, and Less against configurable rules. Reference for glob patterns, --max-warnings,… swcswc is a Rust-based JS/TS compiler. Reference for --out-dir, --config-file, --source-maps, -C options, and th… swiftcswiftc is the Swift compiler. Reference for -o, -O, -emit-library, -target, -sdk, -Xcc, and the Swift compile… taplo formattaplo format formats and canonicalizes TOML files, with --check to gate CI on drift. Reference for the flags… taplo linttaplo lint checks TOML for syntax errors and validates it against a JSON Schema. Reference for --schema, asso… Task in CIRunning Task in CI means installing the go-task binary and calling tasks as steps. Reference for install, --o… Task Taskfile.ymlTask (go-task) runs tasks defined in a YAML Taskfile. Reference for the tasks map, cmds, version, default tas… Task depsTask runs deps in parallel before a task and cmds task: references in order. Reference for deps, calling task… task --listtask --list prints tasks that have a desc, and --list-all includes the rest. Reference for --list, --list-all… Task status checksTask can skip a task when its sources are unchanged or a status command passes. Reference for sources, genera… Task includesTask includes pull tasks from other Taskfiles under a namespace. Reference for the includes map, namespacing,… Task variablesTask supports variables, environment variables, and Go template interpolation. Reference for vars, env, .env… trufflehog excludetrufflehog --exclude-paths, --include-detectors, and --exclude-detectors tune what gets scanned to cut noise… trufflehog gittrufflehog git scans git history and can verify each candidate secret against the live provider. Reference fo… tsctsc is the TypeScript compiler. Reference for --noEmit, --project, --watch, --build, --outDir, --strict, and… tsungtsung runs high-volume, XML-configured load tests across nodes. Reference for tsung -f start, the log dir, an… typedoctypedoc generates documentation from TypeScript source and TSDoc comments. Reference for --out, --entryPoints… upxupx compresses executables in place. Reference for -9, --best, -d, and the "already packed" and AV-false-posi… valgrindvalgrind detects memory errors and leaks at runtime. Reference for --leak-check, --error-exitcode, and making… vegeta attackvegeta attack drives a constant request rate and vegeta report summarizes latencies and status codes. Referen… versions:display-dependency-updatesWhat versions:display-dependency-updates does - lists newer versions of your dependencies via the versions-ma… vite buildvite build produces a production bundle. Reference for --mode, --config, --outDir, --base, --sourcemap, and t… wasm-bindgenThe wasm-bindgen CLI generates JS/TS glue from a Rust-built wasm module. Reference for --target, --out-dir, a… wasm-objdumpwasm-objdump (WABT) dumps the sections, headers, and disassembly of a .wasm module. Reference for -h, -x, -d,… wasm-optwasm-opt (Binaryen) optimizes and shrinks a .wasm module. Reference for -O, -Oz, --enable features, -o, and t… wasm-pack buildwasm-pack build compiles a Rust crate to wasm and generates JS bindings. Reference for --target, --release, -… wasm-pack testwasm-pack test runs Rust wasm tests in Node or a headless browser. Reference for --headless, --chrome, --fire… wasm-stripwasm-strip (WABT) removes custom sections like names and debug info to shrink a module. Reference for usage,… wasm-tools componentwasm-tools component new/wit turns a core module into a component and inspects WIT. Reference for --adapt, ne… wasm-tools printwasm-tools print renders a wasm binary (module or component) as WAT/WIT text. Reference for -o, --skeleton, a… wasm-tools validatewasm-tools validate checks a core module or component against the spec. Reference for --features, component s… wasm-validatewasm-validate (WABT) checks that a .wasm module is well-formed and valid. Reference for --enable features, ex… wasm2watwasm2wat (WABT) converts a .wasm binary back into readable .wat text. Reference for -o, --generate-names, --e… wasmedgewasmedge runs a .wasm module with the WasmEdge runtime. Reference for --dir, --env, --reactor, AOT compile, a… wasmer compilewasmer compile precompiles a module to a native .wasmu artifact. Reference for --llvm, --cranelift, --target,… wasmer runwasmer run executes a local .wasm or a package from the Wasmer registry. Reference for --dir, --mapdir, --env… wasmtime compilewasmtime compile AOT-compiles a .wasm into a native .cwasm for fast startup. Reference for --target, -o, and… wasmtime runwasmtime run executes a WebAssembly or WASI module. Reference for --dir, --env, --invoke, and the parse and i… wat2wasmwat2wasm (WABT) assembles a .wat text file into a .wasm binary. Reference for -o, --enable features, --debug-… webpack-cliwebpack-cli runs webpack builds. Reference for --mode, --config, --entry, --output-path, --analyze, and the w… wrk Lua scriptwrk -s runs a Lua script to build dynamic requests, POST bodies, and custom done() reports. Reference for the… wrkwrk is a modern HTTP benchmarking tool using threads and epoll. Reference for -t, -c, -d, --latency, and the… wrk2wrk2 adds a required -R rate for constant-throughput testing and corrects coordinated omission. Reference for… xcodebuildxcodebuild builds, tests, and archives iOS/macOS projects from the command line. Reference for -workspace, -s… xcrun altoolxcrun altool uploads and validates an .ipa to App Store Connect. Reference for --upload-app, --validate-app,… xmakexmake builds C/C++ projects from an xmake.lua description, with a built-in package manager. Reference for xma… yamaleyamale validates YAML files against a compact Yamale schema. Reference for -s, the validators, and the "Valid… yamllint strictyamllint --strict makes warnings cause a non-zero exit, and --no-warnings hides them. Reference for the exit-… yamllint configyamllint reads .yamllint with extends, per-rule settings, and ignore globs. Reference for the default preset,… yamllintyamllint checks YAML for syntax and style problems. Reference for passing paths, -d inline config, --strict,… zipalignzipalign aligns uncompressed data in an APK to 4-byte boundaries for efficient mmap. Reference for -p, -c, -v…

.pre-commit-config.yamlThe .pre-commit-config.yaml file declares which hook repos and hooks run. Reference for top-level keys, repos… black --checkReference for black --check in CI: verifying formatting without rewriting files, the --diff flag, exit codes… conda activateconda create builds an env and conda activate selects it, but activation needs conda init/shell hook. Referen… default_language_versiondefault_language_version pins the interpreter pre-commit uses to build hook envs. Reference for python, node,… flake8Reference for flake8 in CI: linting for style and simple errors, selecting and ignoring codes, configuration… mambamamba is a fast drop-in for conda with a C++ solver. Reference for mamba create/install, micromamba, the libm… mypy --cache-dirmypy --cache-dir sets where mypy stores its incremental cache. Reference for caching .mypy_cache in CI, --no-… mypy check-untyped-defsmypy --check-untyped-defs type-checks the bodies of functions even when they have no annotations. Reference f… mypy disallow-untyped-defsmypy --disallow-untyped-defs flags functions that lack type annotations. Reference for the flag, its incomple… mypy error-summarymypy --error-summary controls the final "Found N errors" line. Reference for the summary, --no-error-summary,… mypy --excludemypy --exclude skips paths matching a regular expression. Reference for the regex semantics, the config list… mypy explicit-package-basesmypy --explicit-package-bases sets how mypy computes module names from paths. Reference for the flag, MYPYPAT… mypy follow-importsmypy --follow-imports sets how mypy treats modules reached via imports. Reference for normal, silent, skip, e… mypy ignore missing importsmypy --ignore-missing-imports suppresses errors for third-party packages with no type stubs. Reference for sc… mypy --install-typesmypy --install-types installs the typeshed stub packages mypy says are missing. Reference for the non-interac… mypy --junit-xmlmypy --junit-xml writes a JUnit-format report CI systems can ingest. Reference for the flag, exit-code gating… mypy namespace-packagesmypy --namespace-packages enables support for PEP 420 packages without __init__.py. Reference for the flag, i… mypy no-error-summarymypy --no-error-summary suppresses the closing summary line for cleaner machine-parsed output. Reference for… mypy --python-versionmypy --python-version type-checks against the syntax and stdlib of a specific Python version. Reference for t… mypy show-error-codesmypy --show-error-codes appends the error code to each message. Reference for the flag, --hide-error-codes, a… mypy --strictmypy --strict enables the full bundle of strictness flags in one switch. Reference for what it turns on, how… mypy warn-unused-ignoresmypy --warn-unused-ignores reports type: ignore comments that no longer suppress anything. Reference for the… mypy pyproject.tomlConfigure mypy from pyproject.toml under [tool.mypy]. Reference for the table syntax, common keys, and the TO… mypy per-module optionsmypy per-module overrides let you relax or tighten settings for specific modules. Reference for the overrides… mypy type: ignoreA # type: ignore comment suppresses a mypy error on one line. Reference for code-specific ignores, blanket ig… mypyReference for mypy in CI: static type checking, strict mode, caching for speed, handling missing stubs, and a… mypy.iniConfigure mypy with mypy.ini or setup.cfg using INI sections. Reference for [mypy] and [mypy-module] sections… pip cache purgeHow pip cache purge clears pip’s local wheel and HTTP cache, when to use it to reclaim disk on a runner, and… pip cacheReference for pip cache in CI: inspecting and purging pip wheel and HTTP cache, finding the cache dir for cac… pip checkReference for pip check in CI: detecting broken or conflicting installed dependencies, its non-zero exit as a… pip checkHow pip check detects broken or conflicting dependencies, what its non-zero exit means in CI, and how to read… pip configHow pip config sets, lists, and edits pip settings like index URLs and timeouts, where the config files live,… pip downloadReference for pip download in CI: fetching wheels and sdists into a directory for offline or air-gapped insta… pip downloadHow pip download fetches wheels and sdists into a directory for offline CI, the platform-targeting flags, and… pip freezeReference for pip freeze in CI: snapshotting installed versions into requirements.txt, excluding editable/VCS… pip freezeHow pip freeze produces a pinned requirements.txt of the current environment, the gotchas with editable and V… pip index versionsHow pip index versions lists the versions of a package on an index, why it is marked experimental, and how to… pip --no-cache-dirWhen to use pip install --no-cache-dir - smaller Docker images and avoiding stale cached wheels - plus the tr… pip --only-binaryHow pip install --only-binary forces wheel-only installs to avoid slow, fragile source builds in CI, the :all… pip install -eReference for pip install -e (editable installs) in CI: installing the project under test, extras, build-back… pip install -eWhat an editable install does, when to use pip install -e in CI, and the build-backend errors editable instal… pip install -rReference for pip install -r requirements.txt in CI: installing a whole dependency file, hashed installs, con… pip install -rHow pip install -r installs every dependency from a requirements file, the flags that make it reproducible in… pip installReference for pip install in CI pipelines: installing packages, pinning versions, common flags, a GitHub Acti… pip installHow pip install works - installing packages, version specifiers, and the options you reach for, plus the CI f… pip listHow pip list shows installed packages and versions, the --outdated and --format flags useful in CI, and how t… pip listReference for pip list in CI: showing installed packages and versions, --outdated and --format=json for scrip… pip showHow pip show displays a package’s version, location, dependencies, and requirements - plus the non-zero exit… pip uninstallHow pip uninstall removes installed packages, the -y flag CI needs to avoid hanging on a prompt, and the erro… pip wheelReference for pip wheel in CI: building .whl archives for a project and its dependencies into a wheelhouse, t… pip wheelHow pip wheel builds wheel archives for a project and its dependencies, why CI uses it to pre-build a wheelho… pip-compileReference for pip-compile from pip-tools in CI: compiling requirements.in into a fully pinned requirements.tx… poetry addHow poetry add installs a dependency, updates pyproject.toml and poetry.lock, the --group and --dev usage, an… poetry addReference for poetry add in CI and dev: adding a dependency to pyproject.toml and the lock, group and dry-run… poetry buildReference for poetry build in CI: producing a wheel and sdist into dist/ from pyproject.toml, the --format fl… poetry buildHow poetry build produces a wheel and sdist into dist/, the --format flag, and the project-metadata errors it… poetry env useHow poetry env use binds the project to a specific Python interpreter, why CI matrices need it, and the inter… poetry exportHow poetry export converts the lockfile to a requirements.txt for pip stages, the hashes and groups flags, an… poetry installReference for poetry install in CI: installing from poetry.lock, the --no-root, --only, and --no-interaction… poetry installHow poetry install resolves and installs dependencies from poetry.lock, the --no-root and --only flags useful… poetry lockHow poetry lock resolves dependencies and writes poetry.lock without installing, the --no-update flag, and th… poetry lockReference for poetry lock in CI: resolving dependencies into poetry.lock without installing, the consistency… poetry publishHow poetry publish uploads built artifacts to PyPI or a private repository, the --build and --repository flag… poetry publishReference for poetry publish in CI: uploading built artifacts to PyPI or a private repository, --build and --… poetry removeHow poetry remove deletes a dependency from pyproject.toml and poetry.lock, the --group flag, and the error w… poetry runHow poetry run executes a command inside the project’s virtual environment without activating it, common CI u… poetry runReference for poetry run in CI: executing a command inside the project virtualenv without activating it, comm… poetry showHow poetry show lists project dependencies and versions, the --tree and --outdated flags for auditing, and ho… poetry updateHow poetry update upgrades dependencies to the newest versions allowed by pyproject.toml, updates the lock, a… pre-commit cache dirpre-commit caches built hook environments under ~/.cache/pre-commit. Reference for PRE_COMMIT_HOME, what to c… pre-commit autoupdatepre-commit autoupdate updates each repo rev to the latest tag. Reference for --bleeding-edge, --freeze, --rep… pre-commit cleanpre-commit clean deletes the entire hook environment cache. Reference for fixing stale or corrupted environme… fail_fastfail_fast stops the run after the first failing hook. Reference for the top-level and per-hook key and how it… files / excludeThe files and exclude regexes control which paths a hook checks. Reference for top-level vs per-hook filters,… hooks: idThe hooks list selects hook ids and overrides args, files, and types. Reference for id, args, files, exclude,… pre-commit GitHub ActionsRun pre-commit in GitHub Actions with cached hook environments. Reference for the workflow, caching ~/.cache/… pre-commit installpre-commit install writes the git hook scripts so hooks run on commit. Reference for --hook-type, --install-h… language: nodelanguage: node builds a Node environment per hook, downloading Node if needed. Reference for language_version… language: pythonlanguage: python builds an isolated virtualenv per hook from additional_dependencies. Reference for language_… language: systemlanguage: system runs a command already installed on the machine, with no env build. Reference for entry, pas… local hooksrepo: local defines hooks inline using your own commands. Reference for entry, language, files, and the confi… repos / revThe repos and rev keys pin each hook source to a git ref. Reference for repo url, rev tags, frozen shas, and… pre-commit run --all-filespre-commit run --all-files runs every hook against all files, the standard CI invocation. Reference for --sho… pre-commit run <hook-id>pre-commit run <hook-id> runs one hook by id, useful for debugging or targeted CI steps. Reference for --file… pre-commit stagesThe stages key controls which git events trigger a hook (commit, push, manual). Reference for stages, default… pre-commit.cipre-commit.ci is the hosted service that runs hooks, autofixes pull requests, and autoupdates revs. Reference… pyenv-virtualenvpyenv-virtualenv creates and auto-activates virtualenvs tied to a pyenv Python. Reference for virtualenv crea… pyenv build depspyenv install compiles Python from source, so CI needs the build dependencies. Reference for pyenv install/gl… pytest --covReference for pytest --cov from pytest-cov in CI: measuring coverage, enforcing a threshold with --cov-fail-u… pytest -kReference for pytest -k in CI: selecting tests by a name expression with and/or/not operators, sharding a sui… pytest -mReference for pytest -m in CI: selecting tests by registered markers, deselecting slow tests, registering mar… pytest -n (xdist)Reference for pytest -n from pytest-xdist in CI: running tests in parallel across CPUs with -n auto, distribu… pytest -x / --maxfailReference for pytest fail-fast flags in CI: -x to stop on the first failure and --maxfail=N to stop after N,… pytestReference for pytest in CI: running the suite, useful flags, why python -m pytest fixes import errors, and a… python --versionHow python --version reports the interpreter version, why CI should verify it before installing, and the vers… python -cHow python -c runs a snippet of Python directly from the command line, common CI uses like version and import… python -m buildReference for python -m build in CI: producing an sdist and wheel in an isolated environment from pyproject.t… python -m buildHow python -m build creates an sdist and wheel in an isolated environment, what it needs in pyproject.toml, a… python -m pipReference for python -m pip in CI: running pip for a specific interpreter to avoid the wrong-pip-on-PATH prob… python -m pipWhy python -m pip is safer than a bare pip in CI, how it guarantees you install into the intended interpreter… python -m pytestWhy python -m pytest beats a bare pytest in CI, how it adds the current directory to sys.path, and the import… python -m twineHow python -m twine uploads built distributions to PyPI or a private index, the check command to catch metada… python -m venvHow python -m venv creates an isolated virtual environment, how to activate it on Linux and Windows runners,… python -m venvReference for python -m venv in CI: creating an isolated environment, options, and a workflow example showing… python -uWhy python -u (unbuffered stdout/stderr) makes Python logs appear in real time in CI, the PYTHONUNBUFFERED al… python setup.pyReference for python setup.py in CI: legacy build/install invocations, why they are deprecated in favor of py… ruff exit codesruff --exit-zero forces a zero exit and --exit-non-zero-on-fix fails when fixes are applied. Reference for co… ruff github formatruff --output-format=github emits GitHub Actions workflow annotations so violations show inline on the PR. Re… ruff json outputruff --output-format=json emits violations as JSON for tooling and dashboards. Reference for the format, fiel… ruff --previewruff --preview enables rules and behavior still in preview. Reference for the flag, the preview config key, a… ruff select/ignoreruff --select and --ignore turn rules on and off by code or prefix. Reference for selecting rule families, ig… ruff cacheRuff caches results in .ruff_cache to skip unchanged files. Reference for --cache-dir, --no-cache, RUFF_CACHE… ruff check --fixruff check --fix applies safe automatic fixes and rewrites files in place. Reference for the flag, what count… ruff --statisticsruff check --statistics summarizes violations by rule with counts. Reference for the flag, reading the table,… ruff check --watchruff check --watch re-runs the linter whenever files change, for local dev. Reference for the flag, its behav… ruff checkReference for ruff check in CI: fast Python linting, the --fix and --output-format flags, gating on lint erro… ruff checkruff check lints Python files and exits non-zero when violations remain. Reference for paths, exit codes, and… ruff pyproject.tomlRuff reads configuration from [tool.ruff] in pyproject.toml. Reference for the lint and format sections, comm… ruff.tomlruff.toml is a standalone Ruff config that takes precedence over pyproject.toml. Reference for its top-level… ruff extend-selectextend-select adds rules on top of the configured selection instead of replacing it. Reference for the key, -… ruff format --checkruff format --check verifies formatting without writing files and exits non-zero when code is unformatted. Re… ruff format --diffruff format --diff prints a unified diff of formatting changes without writing files. Reference for previewin… ruff formatruff format reformats Python files in place, a Black-compatible formatter. Reference for paths, behavior, and… ruff isort (I)Ruff implements isort as the I rule family and can sort imports with --fix. Reference for enabling I, the iso… ruff line-lengthline-length controls the wrap width for the formatter and the E501 rule. Reference for the key, --line-length… ruff noqaA noqa comment suppresses Ruff violations on a line. Reference for noqa syntax, RUF100 unused-noqa, --add-noq… ruff per-file-ignoresper-file-ignores disables specific Ruff rules for matching file patterns. Reference for the config key, glob… ruff ruleruff rule <code> prints what a rule checks, its rationale, and example fixes. Reference for inspecting rules… ruff target-versiontarget-version tells Ruff the lowest Python version to support, affecting rules and formatting. Reference for… SKIP env varThe SKIP environment variable disables specific hook ids for a single run. Reference for SKIP, comma-separate… source activateReference for activating a virtualenv in CI: source venv/bin/activate on Linux/macOS, the Windows path, and w… toxReference for tox in CI: running tests across multiple Python versions and environments, selecting envs, para… twine checkReference for twine check in CI: validating built distribution metadata and long-description rendering before… twine uploadReference for twine upload in CI: publishing built distributions to PyPI or a private index, token authentica… uv --compile-bytecodeuv --compile-bytecode pre-compiles installed modules to .pyc for faster first imports. Reference for UV_COMPI… uv --no-cacheuv --no-cache disables the cache for a run, useful for clean reproducibility checks. Reference for --refresh,… uv adduv add adds a package to pyproject.toml, resolves it, and updates uv.lock. Reference for --dev, --optional, v… uv builduv build produces a source distribution and wheel into dist/. Reference for --wheel, --sdist, --out-dir, and… uv cache cleanuv cache clean removes cached wheels and metadata to free space or fix corruption. Reference for cleaning a s… uv cache diruv cache dir prints the cache location so CI can cache it. Reference for UV_CACHE_DIR, the default paths, and… uv exportuv export converts uv.lock into a requirements.txt for tools that need it. Reference for --format, --no-hashe… uv extra indexuv installs from private indexes via --index, --default-index, and UV_INDEX. Reference for authentication, in… uv inituv init creates a new project with pyproject.toml and a starter layout. Reference for --lib, --package, --app… uv lock --checkuv lock --check fails if uv.lock is out of date with pyproject.toml, a perfect CI gate. Reference for --locke… uv lockHow uv lock resolves the project’s dependencies into uv.lock, the --check flag for CI gates, and the upgrade… uv managed pythonuv can download and manage its own Python interpreters. Reference for UV_PYTHON_DOWNLOADS, UV_PYTHON, system… uv pip compileHow uv pip compile turns requirements.in into a fully pinned requirements.txt, the --generate-hashes flag, an… uv pip installReference for uv pip install in CI: a fast, pip-compatible installer, shared flags, the must-target-an-enviro… uv pip installHow uv pip install provides a fast, drop-in pip-compatible installer, the flags it shares with pip, and the m… uv pip listuv pip list shows installed packages and versions in the active environment. Reference for --outdated, --form… uv pip syncuv pip sync installs exactly what a requirements file lists, removing anything extra. Reference for multiple… uv publishuv publish uploads built wheels and sdists to PyPI or a private index. Reference for --token, --publish-url,… uv python installuv python install downloads and installs standalone CPython builds. Reference for version requests, --reinsta… uv python pinuv python pin writes a .python-version file so uv selects the same interpreter every run. Reference for the p… uv removeuv remove deletes a package from pyproject.toml and re-resolves uv.lock. Reference for --dev, --group, --opti… uv run --withuv run --with adds packages just for one command without touching the project. Reference for --with, --no-pro… uv runHow uv run executes a command in the project environment, auto-syncing dependencies first, the --frozen flag… uv self updateuv self update upgrades uv to the latest release in place. Reference for pinning a version, the managed-insta… uv sync --extrauv sync --extra installs a project optional-dependency extra. Reference for --all-extras, --no-extra, and the… uv sync --groupuv sync controls dependency groups with --group, --dev, --no-dev, and --only-group. Reference for the group f… uv syncHow uv sync makes the environment match uv.lock exactly, the --frozen and --no-dev flags for CI, and the lock… uv tool installuv tool install installs a Python CLI into an isolated environment and puts it on PATH. Reference for --with,… uv treeuv tree prints the resolved dependency tree for the project. Reference for --depth, --package, --invert, and… uv venvHow uv venv creates a virtual environment quickly, how to pin the Python version with --python, and how it pa… uv venvReference for uv venv in CI: creating a virtual environment quickly, pinning the Python version with --python… uvx / uv tool runuvx, the alias for uv tool run, runs a Python CLI in an ephemeral environment. Reference for --from, --with,…

ansible (ad-hoc)What the ansible ad-hoc command does, how to run one-off module tasks across hosts in CI, and the inventory a… ansible-galaxy installReference for ansible-galaxy install in CI/CD: install roles and collections from a requirements file so a pl… ansible-galaxy installWhat ansible-galaxy install does, how to install roles and collections from requirements.yml in CI, and the d… ansible-inventoryWhat ansible-inventory does, how to list and graph hosts and debug dynamic inventory in CI, and the parsing e… ansible-lintWhat ansible-lint does, how to run it as a CI gate with profiles and SARIF output, and the rule-violation fai… ansible-playbookReference for ansible-playbook in CI/CD: run a playbook against an inventory non-interactively with a vault p… ansible-playbookWhat ansible-playbook does, how to run playbooks non-interactively in CI with inventory and vault, and the ho… ansible-vault encryptWhat ansible-vault encrypt does, how to encrypt secrets and decrypt them non-interactively in CI, and the vau… argocd app syncReference for argocd app sync in CI/CD: trigger an Argo CD application sync to reconcile a cluster with Git a… argocd app syncWhat argocd app sync does, how to sync an Argo CD app non-interactively in CI with login and wait, and the au… aws apigateway create-deploymentaws apigateway create-deployment publishes a REST API to a stage. Learn the rest-api-id and stage-name flags,… aws cfn create-change-setaws cloudformation create-change-set previews what a template change will do before applying it. Reference fo… aws cloudformation deployaws cloudformation deploy creates or updates a stack via change sets. Learn the parameter-overrides and capab… aws cloudformation deployWhat aws cloudformation deploy does, how to deploy a stack with parameters and capabilities in CI, and the ro… aws cfn describe-stacksaws cloudformation describe-stacks returns stack status and outputs. Reference for --stack-name, extracting o… aws cloudfront create-invalidationaws cloudfront create-invalidation purges cached paths from a CloudFront distribution after a deploy. Learn t… aws cloudwatch put-metric-dataaws cloudwatch put-metric-data publishes custom metrics like deploy counts or durations. Reference for --name… aws codeartifact loginaws codeartifact login configures npm, pip, or twine to use a CodeArtifact repository. Reference for --tool,… aws codedeploy create-deploymentaws codedeploy create-deployment starts a CodeDeploy deployment from an S3 or GitHub revision. Learn the appl… aws configure ssoaws configure sso sets up an IAM Identity Center (SSO) profile for the AWS CLI. Learn the flags, an example,… aws configureaws configure sets AWS CLI credentials, region, and profiles. Learn the flags, a CI example, and why pipeline… aws configureWhat aws configure does, how to set credentials and named profiles, why CI should prefer OIDC roles over stat… aws dynamodb put-itemaws dynamodb put-item writes a single item with typed attributes. Reference for --item, --condition-expressio… aws dynamodb put-itemaws dynamodb put-item writes or replaces an item in a DynamoDB table. Learn the item, condition-expression, a… aws dynamodb queryaws dynamodb query reads items by partition key with a key condition expression. Reference for --key-conditio… aws ec2 create-tagsaws ec2 create-tags adds or overwrites tags on EC2 resources. Reference for --resources, --tags, the InvalidI… aws ec2 describe-imagesaws ec2 describe-images looks up AMIs by owner, name, and filters. Reference for --filters, --owners, picking… aws ec2 describe-instancesWhat aws ec2 describe-instances does, how to filter by tag and state and shape output with --query in CI, and… aws ec2 describe-instancesaws ec2 describe-instances lists EC2 instances with filtering and JMESPath queries. Learn the filters and que… aws ec2 describe-security-groupsaws ec2 describe-security-groups lists security groups and their rules. Reference for --filters, --group-ids,… aws ec2 run-instancesaws ec2 run-instances launches one or more EC2 instances from an AMI. Reference for --image-id, --instance-ty… aws ecr create-repositoryWhat aws ecr create-repository does, how to create an image repo with scanning and immutable tags in CI, and… aws ecr describe-imagesWhat aws ecr describe-images does, how to list image tags, digests, and scan findings in CI, and the reposito… aws ecr describe-repositoriesaws ecr describe-repositories lists ECR repositories and their URIs. Learn the repository-names and query fla… aws ecr get-login-passwordWhat aws ecr get-login-password does, how to pipe it into docker login to push images in CI, and the auth and… aws ecr get-login-passwordaws ecr get-login-password returns a short-lived token to authenticate Docker with ECR. Learn the canonical p… aws ecs describe-servicesaws ecs describe-services reports the status, deployments, and running counts of ECS services. Use it in CI t… aws ecs describe-tasksaws ecs describe-tasks reports the status and exit codes of ECS tasks. Reference for --tasks, --cluster, read… aws ecs register-task-definitionaws ecs register-task-definition creates a new task definition revision from JSON. Learn the cli-input-json f… aws ecs run-taskaws ecs run-task launches a standalone task (migrations, batch jobs) on ECS. Reference for --launch-type FARG… aws ecs update-serviceaws ecs update-service triggers a new ECS deployment with an updated task definition. Learn the force-new-dep… aws eks describe-clusterWhat aws eks describe-cluster does, how to read cluster status, endpoint, and version before connecting in CI… aws eks list-clustersaws eks list-clusters returns the EKS cluster names in a region. Reference for --query, the region gotcha, pa… aws eks update-kubeconfigaws eks update-kubeconfig writes a kubeconfig entry so kubectl can reach an EKS cluster. Learn the name and r… aws eks update-kubeconfigWhat aws eks update-kubeconfig does, how to wire kubectl to an EKS cluster in CI, and the auth and access-ent… aws elasticbeanstalk update-environmentaws elasticbeanstalk update-environment deploys a new application version to an Elastic Beanstalk environment… aws elbv2 target-healthaws elbv2 describe-target-health reports the health of targets in a target group. Reference for --target-grou… aws iam attach-role-policyaws iam attach-role-policy attaches a managed policy to an IAM role. Reference for --policy-arn, the NoSuchEn… aws iam create-policyaws iam create-policy creates a customer-managed IAM policy from a JSON document. Reference for --policy-docu… aws iam create-roleaws iam create-role creates an IAM role with a trust policy - including the OIDC trust used by GitHub Actions… aws iam create-roleWhat aws iam create-role does, how to create a role with a trust policy for OIDC or services in CI, and the p… aws lambda invokeaws lambda invoke calls a function and captures its response. Reference for --payload, --cli-binary-format, -… aws lambda invokeaws lambda invoke runs a Lambda function and captures its response. Learn the payload, log-type, and cli-bina… aws lambda publish-versionaws lambda publish-version creates an immutable version of a function for safe rollouts. Reference for --revi… aws lambda update-function-codeaws lambda update-function-code deploys new Lambda code from a zip or ECR image. Learn the zip-file, image-ur… aws lambda update-function-codeWhat aws lambda update-function-code does, how to deploy a zip or container image to Lambda in CI, and the de… aws lambda update-function-configaws lambda update-function-configuration changes memory, timeout, env vars, and more. Reference for --environ… aws logs filter-log-eventsaws logs filter-log-events searches a CloudWatch log group by pattern and time. Reference for --filter-patter… aws logs tailaws logs tail streams or fetches CloudWatch Logs for a log group. Learn the follow, since, and filter-pattern… aws logs tailWhat aws logs tail does, how to stream and filter CloudWatch Logs live in CI debugging, and the group-name an… aws s3 cpaws s3 cp uploads and downloads objects with the AWS CLI, including recursive and streaming copies. Reference… aws s3 cpaws s3 cp copies files and directories to and from S3. Learn the recursive, exclude, and ACL flags plus a CI… aws s3 cpWhat aws s3 cp does, how to upload, download, and stream objects in CI, recursive copies, and the access and… aws s3 lsaws s3 ls lists buckets, prefixes, and objects in S3. Learn the recursive, human-readable, and summarize flag… aws s3 lsWhat aws s3 ls does, how to list buckets and objects with prefixes and recursion in CI, and the access and pa… aws s3 presignaws s3 presign creates a time-limited URL to download or share an S3 object without credentials. Learn the ex… aws s3 presignaws s3 presign creates a time-limited signed URL to download or upload an object without sharing credentials.… aws s3 presignaws s3 presign creates a time-limited URL for a private S3 object. Reference for --expires-in, the credential… aws s3 rmWhat aws s3 rm does, how to delete objects and prefixes recursively in CI cleanup, the dryrun safety net, and… aws s3 rmaws s3 rm deletes one object or, with --recursive, a whole prefix in S3. Reference for --recursive, --exclude… aws s3 rmaws s3 rm deletes objects from S3, optionally recursively. Learn the recursive, exclude, and dryrun flags, a… aws s3 syncaws s3 sync copies only changed files to or from S3, and --delete removes extras. Reference for --delete, --e… aws s3 syncaws s3 sync uploads only changed files to S3, making it ideal for static site deploys in CI. Learn the delete… aws s3 syncWhat aws s3 sync does, how to deploy a directory to S3 in CI, --delete and --exclude, and the deploy and cach… aws s3api create-bucketaws s3api create-bucket provisions a new S3 bucket. Learn the region constraint quirk, key flags, a CI exampl… aws s3api get-objectaws s3api get-object downloads a single object with full control over the request, unlike the high-level s3 c… aws s3api list-objects-v2aws s3api list-objects-v2 lists object keys with prefix, pagination, and JMESPath control. Reference for --pr… aws s3api put-objectaws s3api put-object uploads a single object with explicit control over metadata, ACL, and encryption. Refere… aws s3api put-objectaws s3api put-object uploads a single object with explicit metadata, content-type, SSE, and ACL control. Refe… aws secretsmanager get-secret-valueaws secretsmanager get-secret-value retrieves a secret from Secrets Manager. Learn the secret-id and query fl… aws secretsmanager get-secret-valueWhat aws secretsmanager get-secret-value does, how to read and parse JSON secrets in CI, and the access and p… aws sns publishaws sns publish sends a message to an SNS topic for fan-out or alerts. Reference for --topic-arn, --message,… aws sqs send-messageaws sqs send-message enqueues a message to an SQS queue. Reference for --queue-url, FIFO group/dedup IDs, --m… aws sqs send-messageaws sqs send-message enqueues a message to an SQS queue. Learn the queue-url, message-body, and FIFO group fl… aws ssm get-parameteraws ssm get-parameter reads a value from SSM Parameter Store, decrypting SecureStrings. Learn the with-decryp… aws ssm get-parameterWhat aws ssm get-parameter does, how to read SSM Parameter Store values and SecureStrings in CI, and the decr… aws ssm get-parametersaws ssm get-parameters reads one or more Parameter Store values. Reference for --names, --with-decryption, th… aws ssm put-parameteraws ssm put-parameter creates or updates a Parameter Store value. Reference for --type, --overwrite, SecureSt… aws ssm send-commandaws ssm send-command runs shell commands on managed EC2 instances without SSH. Reference for --document-name,… aws sts assume-roleaws sts assume-role returns temporary credentials for a target role, enabling cross-account deploys. Learn th… aws sts assume-roleaws sts assume-role returns temporary credentials for a role. Reference for --role-arn, --role-session-name,… aws sts get-caller-identityWhat aws sts get-caller-identity does, how to confirm which identity the CLI is using in CI, and the credenti… aws sts get-caller-identityaws sts get-caller-identity returns the account, user, and ARN for the current credentials. Use it to verify… az account listaz account list shows every subscription the identity can see. Reference for --query, --all, --refresh, and t… az account setWhat az account set does, how to select the active Azure subscription in CI, and the subscription-not-found a… az account showaz account show prints the active Azure subscription and tenant. Reference for --query, --output, and the "Pl… az acr buildWhat az acr build does, how to build and push images with ACR Tasks (no local Docker) in CI, and the context… az acr createWhat az acr create does, how to create an Azure Container Registry with the right SKU in CI, and the name and… az acr importaz acr import copies an image into ACR from another registry without a local pull. Reference for --source, --… az acr loginLog Docker into Azure Container Registry from CI: flags, a push example, and the registry authentication erro… az acr loginWhat az acr login does, how to authenticate Docker to Azure Container Registry in CI, the token mode, and the… az acr repository listaz acr repository list shows repositories in an Azure Container Registry. Reference for --name, show-tags, --… az ad sp create-for-rbacWhat az ad sp create-for-rbac does, how to create a scoped service principal for CI, why to prefer OIDC, and… az aks createaz aks create provisions a managed Kubernetes cluster. Reference for --node-count, --enable-managed-identity,… az aks get-credentialsFetch AKS cluster credentials into kubeconfig from CI: the key flags, a pipeline example, and the auth and ac… az aks get-credentialsaz aks get-credentials merges an AKS cluster into kubeconfig for kubectl. Reference for --admin, --file, --ov… az aks get-credentialsWhat az aks get-credentials does, how to wire kubectl to an AKS cluster in CI, kubelogin for AAD, and the aut… az config setaz config set tunes Azure CLI behavior and defaults. Reference for core.output, defaults.group, extension.use… az containerapp createaz containerapp create deploys a container to Azure Container Apps. Reference for --image, --environment, --i… az containerapp updateUpdate an Azure Container App image from CI: image and env flags, a deploy example, and the revision errors y… az deployment group createaz deployment group create deploys an ARM or Bicep template to a resource group. Reference for --template-fil… az deployment sub createaz deployment sub create deploys a template at subscription scope, e.g. to create resource groups. Reference… az extension addaz extension add installs az CLI extensions like containerapp and ml. Reference for --name, --upgrade, --vers… az functionapp createaz functionapp create provisions an Azure Functions app. Reference for --consumption-plan-location, --runtime… az functionapp deploymentDeploy an Azure Functions app from CI via zip deployment: flags, a pipeline example, and the deploy errors yo… az group createCreate an Azure resource group from CI: required flags, an idempotent example, and the location and permissio… az group createWhat az group create does, how to create an Azure resource group with a location in CI, idempotency, and the… az group listaz group list enumerates resource groups in the active subscription. Reference for --query tag filters, --out… az identity createaz identity create makes a user-assigned managed identity for federated OIDC. Reference for clientId, princip… az keyvault createaz keyvault create provisions an Azure Key Vault. Reference for --enable-rbac-authorization, --sku, --locatio… az keyvault secret setaz keyvault secret set writes a secret to Key Vault. Reference for --value, --file, --vault-name, and the For… az keyvault secret showRead a secret from Azure Key Vault in CI: flags to extract the value, an example, and the access policy error… az keyvault secret showWhat az keyvault secret show does, how to read a Key Vault secret value in CI, RBAC vs access policies, and t… az loginAuthenticate the Azure CLI in CI with a service principal or federated token: flags, an example, and the auth… az loginWhat az login does, how to authenticate CI with a service principal or OIDC (not interactive), and the tenant… az monitor log-analyticsaz monitor log-analytics query runs KQL against a workspace for CI assertions. Reference for --workspace, --a… az restaz rest sends authenticated requests to Azure REST APIs the CLI does not wrap. Reference for --method, --url,… az role assignment createaz role assignment create grants an Azure RBAC role to an identity. Reference for --assignee, --role, --scope… az sql db createaz sql db create provisions a database on an Azure SQL server. Reference for --server, --service-objective, -… az storage account createaz storage account create provisions a Storage account. Reference for --sku, --kind, --allow-blob-public-acce… az storage blob downloadaz storage blob download fetches a blob to a local file. Reference for --auth-mode login, --file, batch downl… az storage blob listWhat az storage blob list does, how to list blobs in a container with auth modes and prefixes in CI, and the… az storage blob uploadUpload a file to Azure Blob Storage from CI: container and auth flags, an example, and the storage errors you… az storage blob uploadWhat az storage blob upload does, how to upload to Azure Blob Storage with auth modes in CI, and the auth and… az storage container createaz storage container create makes a blob container. Reference for --auth-mode login, --account-name, --public… az versionaz version reports the core CLI and installed extension versions. Reference for --query, pinning in CI, and d… az vm createaz vm create provisions a Linux or Windows VM. Reference for --image, --size, --generate-ssh-keys, --public-i… az vm listWhat az vm list does, how to list and filter Azure VMs with --query and JMESPath in CI, and the subscription… az vm run-commandaz vm run-command invoke executes scripts inside a VM without SSH. Reference for --command-id RunShellScript,… az webapp configaz webapp config and config appsettings tune an App Service app. Reference for appsettings set, --settings, c… az webapp deployWhat az webapp deploy does, how to push a zip or artifact to Azure App Service in CI, and the deploy and star… az webapp deployDeploy a zip or artifact to Azure App Service from CI: source and type flags, an example, and the deploy erro… az webapp log tailaz webapp log tail streams live App Service logs for debugging deploys. Reference for log config, --provider,… azcopy copyazcopy copy transfers files to and from Azure Blob Storage with SAS tokens or AAD auth. Reference for --recur… azcopy syncazcopy sync makes an Azure Blob container match a local directory, with --delete-destination to purge extras.… b2 syncb2 sync mirrors a local directory to a Backblaze B2 bucket, with --delete and --keepDays. Reference for the s… b2 upload-fileb2 upload-file (b2 file upload in newer CLIs) uploads one file to a Backblaze B2 bucket with a chosen key. Re… cdk bootstrapReference for cdk bootstrap in CI/CD: provision the CDK toolkit stack (S3 assets bucket, ECR repo, roles) an… cdk bootstrapWhat cdk bootstrap does, why every CDK account/region needs it, how to run it in CI, and the permission and t… cdk deployReference for cdk deploy in CI/CD: synthesize and deploy AWS CDK stacks non-interactively with --require-appr… cdk deployWhat cdk deploy does, how to deploy stacks non-interactively in CI with --require-approval never, and the boo… cdk diffReference for cdk diff in CI/CD: compare synthesized CDK stacks against deployed CloudFormation, surface reso… cdk diffWhat cdk diff does, how to gate PRs on stack changes with a nonzero exit, and the credentials and template er… cdk synthReference for cdk synth in CI/CD: synthesize AWS CDK apps to CloudFormation templates for validation, artifac… cdk synthWhat cdk synth does, how to produce CloudFormation templates as a CI artifact, and the context and synthesis… checkov baselinecheckov --create-baseline records current findings so only new ones fail. Reference for --create-baseline, --… checkov skip-checkcheckov --skip-check and inline checkov:skip comments suppress specific policies. Reference for --check, --sk… checkov soft-failcheckov --soft-fail makes scans exit 0 so findings are reported but do not break the build. Reference for sof… checkov scancheckov scans Terraform, CloudFormation, and Kubernetes for security misconfigurations. Reference for -d, -f,… checkov sarifcheckov -o sarif writes SARIF for GitHub code scanning. Reference for the output flag, upload step, and the m… consul acl token createconsul acl token create issues an ACL token bound to policies or roles. Reference for -policy-name, -role-nam… consul agentconsul agent starts a Consul client or server process. Reference for -dev, -server, -bootstrap-expect, -retry… consul catalog servicesconsul catalog services lists all services registered across the Consul cluster. Reference for -tags, -node,… consul connectconsul connect manages Consul service mesh sidecars and CA. Reference for the proxy subcommand, -sidecar-for,… consul kv deleteconsul kv delete removes a key or a subtree from Consul KV. Reference for -recurse, -cas, -modify-index, and… consul kv getconsul kv get reads a value or subtree from the Consul KV store. Reference for -recurse, -keys, -detailed, -r… consul kv getWhat consul kv get does, how to read keys and prefixes from Consul’s KV store in CI, and the address and ACL… consul kv putconsul kv put writes a key/value into the Consul KV store. Reference for -flags, -cas, -modify-index, and the… consul membersconsul members lists the agents in the Consul gossip pool with status and address. Reference for -detailed, -… consul services registerconsul services register adds a service definition to the local Consul agent. Reference for the definition fi… consul snapshot saveconsul snapshot save writes a point-in-time backup of Consul server state. Reference for the output file, -st… doctl apps create-deploymentReference for doctl apps create-deployment in CI/CD: trigger a new DigitalOcean App Platform deployment and o… doctl apps deploydoctl apps create-deployment triggers a new DigitalOcean App Platform deployment. Reference for --access-toke… doctl registry / k8sdoctl registry login authenticates Docker to DOCR and doctl kubernetes cluster kubeconfig wires kubectl to DO… fly deployReference for fly deploy (flyctl) in CI/CD: build and release a Fly.io app non-interactively with a deploy to… fly deploy (flyctl)What fly deploy does, how to deploy a Fly.io app non-interactively in CI with FLY_API_TOKEN, and the auth and… fly secrets setReference for fly secrets set (flyctl) in CI/CD: set encrypted runtime secrets on a Fly.io app and control wh… fly secrets set (flyctl)What fly secrets set does, how to set app secrets in CI and stage them without an immediate redeploy, and the… flyctl deployflyctl deploy (fly deploy) builds and releases an app to Fly.io. Reference for --remote-only, --app, the FLY_… flyctl scale / statusflyctl scale, status, and ssh console manage and inspect Fly.io apps. Reference for scale count, scale vm, st… flyctl secrets setflyctl secrets set stores encrypted secrets for a Fly.io app and triggers a release. Reference for --stage, -… gcloud app browsegcloud app browse prints (or opens) an App Engine service URL. Reference for --no-launch-browser, --service,… gcloud app deployDeploy an App Engine service from a pipeline: version and promote flags, a CI example, and the deploy errors… gcloud artifacts imagesgcloud artifacts docker images list shows Docker images in Artifact Registry. Reference for the repo path, --… gcloud artifacts repositories createWhat gcloud artifacts repositories create does, how to create a Docker/npm Artifact Registry repo for CI, and… gcloud ar repos listgcloud artifacts repositories list shows Artifact Registry repositories. Reference for --location, --format,… gcloud auth activate-service-accountAuthenticate gcloud in CI with a service account key file: required flags, a GitHub Actions example, and the… gcloud auth activate-service-accountWhat gcloud auth activate-service-account does, how to authenticate CI with a key file (and prefer WIF), and… gcloud auth configure-dockerConfigure Docker to authenticate to Artifact Registry and GCR via gcloud: flags, a CI example, and the auth e… gcloud auth configure-dockerWhat gcloud auth configure-docker does, how to wire Docker to Artifact Registry or GCR in CI, the per-region… gcloud auth loginWhat gcloud auth login does, why it is the wrong choice in CI (use service accounts/WIF), and the browser and… gcloud print-access-tokengcloud auth print-access-token prints a short-lived OAuth token for API calls and Docker logins. Reference fo… gcloud builds loggcloud builds log fetches the logs of a Cloud Build run. Reference for the build ID, --stream, --region, and… gcloud builds submitSubmit a build to Cloud Build from CI: key flags for tag and config, a pipeline example, and the build errors… gcloud builds submitWhat gcloud builds submit does, how to build and push container images with Cloud Build in CI, and the permis… gcloud components installgcloud components install adds SDK components like kubectl and gke-gcloud-auth-plugin. Reference for --quiet… gcloud firewall-rules creategcloud compute firewall-rules create adds a VPC firewall rule. Reference for --allow, --source-ranges, --targ… gcloud instances creategcloud compute instances create provisions a Compute Engine VM. Reference for --machine-type, --image-family,… gcloud instances deletegcloud compute instances delete removes a Compute Engine VM. Reference for --zone, --quiet, --keep-disks, and… gcloud compute instances listWhat gcloud compute instances list does, how to filter and format VM output for scripts in CI, and the projec… gcloud compute instances listList Compute Engine instances from a pipeline: filter and format flags, a scripting example, and the common A… gcloud networks creategcloud compute networks create makes a VPC network. Reference for --subnet-mode, custom subnets, and the auto… gcloud compute scpgcloud compute scp copies files between CI and a Compute Engine VM over SSH. Reference for --recurse, --tunne… gcloud compute sshgcloud compute ssh opens an SSH session to a Compute Engine VM, managing keys for you. Reference for --comman… gcloud configurationsgcloud config configurations manages named CLI profiles for multiple projects and accounts. Reference for cre… gcloud config setWhat gcloud config set does, how to set the active project and region/zone for CI, configurations, and the pr… gcloud clusters creategcloud container clusters create provisions a GKE cluster. Reference for --num-nodes, --machine-type, autopil… gcloud container clusters get-credentialsWhat gcloud container clusters get-credentials does, how to wire kubectl to GKE in CI, the gke-gcloud-auth-pl… gcloud container clusters get-credentialsFetch GKE cluster credentials into kubeconfig from CI: required flags, an example, and the auth-plugin and ac… gcloud images listgcloud container images list shows images in Container Registry. Reference for --repository, list-tags, --fil… gcloud functions deployDeploy a Cloud Function from a pipeline: runtime and trigger flags, a CI example, and the deployment errors t… gcloud functions deployWhat gcloud functions deploy does, how to deploy a Cloud Function (gen2) with a trigger and runtime in CI, an… gcloud functions logsgcloud functions logs read fetches logs for a Cloud Function. Reference for --limit, --region, --gen2, and th… gcloud iam roles creategcloud iam roles create defines a custom IAM role with a precise permission set. Reference for --permissions,… gcloud iam service-accounts createWhat gcloud iam service-accounts create does, how to create a CI service account and grant roles, why to avoi… gcloud wif pools creategcloud iam workload-identity-pools create sets up keyless OIDC auth for CI. Reference for pools, providers, -… gcloud infogcloud info prints the active account, project, config paths, and component versions. Reference for --run-dia… gcloud kms encryptgcloud kms encrypt encrypts a file with a Cloud KMS key. Reference for --key, --keyring, --location, --plaint… gcloud logging readgcloud logging read queries Cloud Logging with a filter. Reference for the filter syntax, --freshness, --limi… gcloud projects add-iam-policy-bindingWhat gcloud projects add-iam-policy-binding does, how to grant a role to a member at project scope in CI, and… gcloud projects listgcloud projects list shows the GCP projects an identity can access. Reference for --filter, --format, --sort-… gcloud pubsub publishgcloud pubsub topics publish sends a message to a Pub/Sub topic. Reference for --message, --attribute, the to… gcloud run deployDeploy a container or source to Cloud Run from a pipeline: the flags you need, a CI example, and the deploy e… gcloud run deployWhat gcloud run deploy does, how to deploy a container or source to Cloud Run in CI, and the image, IAM, and… gcloud run jobs executegcloud run jobs execute runs a Cloud Run Job, ideal for CI migrations and batch tasks. Reference for --wait,… gcloud run describegcloud run services describe shows a Cloud Run service in detail. Reference for --region, --format value(stat… gcloud run services listgcloud run services list shows Cloud Run services. Reference for --region, --platform, --format, and the plat… gcloud secrets creategcloud secrets create makes a Secret Manager secret and seeds its first version. Reference for --data-file, -… gcloud secrets versions accessRead a Secret Manager secret value from a pipeline: required arguments, a CI example, and the access errors y… gcloud secrets versions accessWhat gcloud secrets versions access does, how to read a Secret Manager secret value in CI, and the permission… gcloud services enableWhat gcloud services enable does, how to turn on the GCP APIs a pipeline needs in CI, and the permission and… gcloud sql creategcloud sql instances create provisions a Cloud SQL instance for tests. Reference for --database-version, --ti… gcloud storage cpCopy files to and from Cloud Storage in CI: recursive and parallel flags, an upload example, and the bucket a… gcloud storage cpWhat gcloud storage cp does, how it replaces gsutil cp for GCS uploads in CI, recursive copies, and the acces… gcloud storage rsyncgcloud storage rsync mirrors a directory to or from a GCS bucket. Reference for --recursive, --delete-unmatch… gcloud versiongcloud version prints the Cloud SDK and component versions. Reference for --format, pinning versions in CI, a… gh apiReference for gh api in CI/CD: call any REST or GraphQL endpoint with authentication handled, pass fields, pa… gh apiWhat gh api does, how to call REST and GraphQL endpoints with auth, pagination, and jq filters in CI, and the… gh auth loginReference for gh auth login in CI/CD: authenticate the GitHub CLI non-interactively with a token via stdin or… gh auth loginWhat gh auth login does, how to authenticate the GitHub CLI interactively or with a token in CI, and the auth… gh auth statusWhat gh auth status shows, how to verify the active GitHub CLI token and its scopes in CI, and the errors you… gh gist createWhat gh gist create does, how to create public or secret gists from files or stdin in CI, and the errors you… gh issue createReference for gh issue create in CI/CD: open an issue non-interactively with title, body, labels, and assigne… gh issue createWhat gh issue create does, how to open an issue non-interactively in CI with labels and assignees, and the er… gh issue listWhat gh issue list does, how to filter issues by state, label, and assignee, format them as JSON in CI, and t… gh pr checkoutWhat gh pr checkout does, how to check out a pull request branch locally including from forks, the CI shallow… gh pr commentReference for gh pr comment in CI/CD: post or update a comment on a pull request from a pipeline, ideal for p… gh pr createReference for gh pr create in CI/CD: open a pull request non-interactively with title, body, base, and labels… gh pr createWhat gh pr create does, how to open a pull request non-interactively in CI with title, body, base, and labels… gh pr listWhat gh pr list does, how to filter pull requests by state, author, and label, format them as JSON in CI, and… gh pr mergeReference for gh pr merge in CI/CD: merge a pull request non-interactively with squash, merge, or rebase stra… gh pr mergeWhat gh pr merge does, how to merge, squash, or rebase a PR non-interactively in CI with auto-merge, and the… gh pr viewWhat gh pr view does, how to read a pull request’s details, review status, and checks as JSON for CI gating,… gh release createReference for gh release create in CI/CD: cut a GitHub release from a tag, attach build artifacts, and auto-g… gh release createWhat gh release create does, how to cut a tagged GitHub release with auto-generated notes and asset uploads i… gh release uploadWhat gh release upload does, how to attach assets to an existing release in CI, clobber duplicates, and the e… gh repo cloneReference for gh repo clone in CI/CD: clone a repository with gh authentication, pass git clone flags after a… gh repo cloneWhat gh repo clone does, how it differs from git clone, how to pass git flags in CI, and the auth errors you… gh repo createWhat gh repo create does, how to create a repo non-interactively in CI from a local dir or template, and the… gh repo viewWhat gh repo view does, how to read repository metadata like default branch and visibility as JSON in CI, and… gh run listWhat gh run list does, how to filter Actions runs by workflow, branch, and status in CI, and the errors you h… gh run viewWhat gh run view does, how to inspect a workflow run’s jobs and pull only the failed-step logs in CI for fast… gh run watchReference for gh run watch in CI/CD: stream a workflow run until it finishes and exit nonzero on failure, so… gh run watchWhat gh run watch does, how to block on a workflow run and fail the job on its failure, and the errors you hi… gh secret setReference for gh secret set in CI/CD: create or update Actions, environment, or Dependabot secrets non-intera… gh secret setWhat gh secret set does, how to set Actions, environment, and org secrets non-interactively in CI, and the er… gh variable setWhat gh variable set does, how to set Actions configuration variables at repo, env, or org level in CI, and t… gh workflow listWhat gh workflow list does, how to enumerate GitHub Actions workflows with their states and IDs in CI, and th… gh workflow runReference for gh workflow run in CI/CD: trigger a workflow_dispatch run from the CLI, pass inputs, and pick a… gh workflow runWhat gh workflow run does, how to trigger a workflow_dispatch with inputs and a ref in CI, and the errors you… gh-pages (deploy)Reference for the gh-pages CLI in CI/CD: publish a built static site directory to a gh-pages branch non-inter… gsutil cpgsutil cp uploads and downloads objects on Google Cloud Storage, with -m for parallelism. Reference for -m, -… gsutil rsyncgsutil rsync -r synchronizes a directory with a GCS bucket, with -d to delete extras and -m for speed. Refere… helm installInstall a Helm chart as a release in CI: values, namespace, and wait flags, an example, and the install error… helm lintLint a Helm chart in CI before deploying: values and strict flags, an example, and the lint errors that shoul… helm repo addAdd a Helm chart repository in CI: auth and force flags, an example with repo update, and the repo errors you… helm rollbackRoll a Helm release back to a previous revision in CI: revision and wait flags, an example, and the rollback… helm templateRender a Helm chart to plain manifests in CI: values and output flags, a diff example, and the templating err… helm testRun a Helm release test hook in CI: logs and timeout flags, a post-deploy example, and the errors that mean a… helm upgradeUpgrade a Helm release in CI with --install and --atomic: key flags, a deploy example, and the upgrade errors… heroku config / pgheroku config:set manages config vars and heroku pg inspects Heroku Postgres. Reference for --app, pg:info, p… heroku containerheroku container:push and container:release deploy a Docker image to Heroku. Reference for --app, HEROKU_API_… iam:PassRoleiam:PassRole lets a principal hand a role to a service like EC2, Lambda, or ECS. Reference for why CI deploys… infracost breakdowninfracost breakdown estimates the monthly cost of Terraform resources. Reference for --path, --format, the AP… infracost commentinfracost comment posts or updates a cost estimate comment on a pull request. Reference for the github subcom… infracost diffinfracost diff shows the cost delta a Terraform change introduces. Reference for --path, --compare-to, the JS… kubectl applyApply Kubernetes manifests declaratively in CI: the flags you use most, a pipeline example, and the apply err… kubectl config use-contextSwitch the active kubeconfig context in CI: usage, a multi-cluster example, and the errors that mean a missin… kubectl create secretCreate Kubernetes secrets in CI: generic and docker-registry flags, an idempotent example, and the AlreadyExi… kubectl deleteDelete Kubernetes resources in CI: file, selector, and ignore-not-found flags, a cleanup example, and the err… kubectl describeShow detailed resource state and events in CI: usage, a debugging example, and the errors that indicate the w… kubectl execExecute a command inside a running pod from CI: container and stdin flags, a migration example, and the error… kubectl get podsList and inspect pods in CI: output and selector flags, a scripting example, and the errors that point to acc… kubectl logsFetch container logs in CI: selector, previous, and tail flags, a debug example, and the errors you hit when… kubectl rollout statusWait for a Kubernetes rollout to finish in CI: timeout flags, a gating example, and the errors that mean a st… kubectl rollout undoRoll back a Kubernetes Deployment from CI: revision flags, an automated-rollback example, and the errors you… kubectl set imageUpdate a container image on a Deployment from CI: syntax, a rollout example, and the errors that come from wr… kubectl waitWait for a Kubernetes condition in CI: --for and --timeout flags, a readiness-gate example, and the timeout e… kustomize buildReference for kustomize build in CI/CD: render an overlay into final Kubernetes manifests for validation, dif… kustomize buildWhat kustomize build does, how to render manifests for a kubectl apply in CI, and the resource-path and plugi… kustomize editWhat kustomize edit does, how to set an image tag in CI without hand-editing YAML, and the missing-file error… mc alias setmc alias set registers an S3-compatible endpoint and credentials under a short name. Reference for the comman… mc cpmc cp copies files to and from S3-compatible object storage with the MinIO client. Reference for --recursive,… mc mirrormc mirror keeps a target bucket in sync with a source, optionally removing extra objects. Reference for --ove… netlify deploynetlify deploy --prod publishes a build directory to production via the Netlify CLI. Reference for --dir, --p… netlify deployReference for netlify deploy in CI/CD: push a built site to a draft or production deploy non-interactively us… netlify env / linknetlify env:set manages environment variables and netlify link binds a folder to a site. Reference for --cont… netlify functionsnetlify functions:create, build, serve, and invoke manage Netlify Functions. Reference for --functions, local… nomad acl token createnomad acl token create issues a Nomad ACL token bound to policies. Reference for -policy, -type, -ttl, and th… nomad alloc execnomad alloc exec runs a command inside a running tasks container for debugging. Reference for -task, -i, -t,… nomad alloc logsnomad alloc logs streams stdout/stderr for a task in an allocation. Reference for -stderr, -f, -tail, -job, a… nomad alloc statusnomad alloc status shows the state, events, and resource usage of an allocation. Reference for -stats, -verbo… nomad deployment statusnomad deployment status reports a deployments health and progress for safe CI deploys. Reference for -monitor… nomad job plannomad job plan previews scheduler changes without applying them and returns a modify index. Reference for -di… nomad job runnomad job run submits a job specification to the Nomad scheduler. Reference for -check-index, -detach, -var,… nomad job runWhat nomad job run does, how to submit and deploy a job spec in CI, and the address, ACL, and placement error… nomad job statusnomad job status shows a jobs allocations, deployment, and evaluations. Reference for -short, -evals, -all-al… nomad job stopnomad job stop deregisters a Nomad job and stops its allocations. Reference for -purge, -detach, -global, and… nomad namespacenomad namespace creates and lists namespaces that isolate jobs and variables. Reference for apply, list, -nam… nomad node statusnomad node status lists client nodes with eligibility and drain state. Reference for -self, -allocs, -verbose… nomad var putnomad var put writes an encrypted Nomad variable for jobs to consume. Reference for -in, -check-index, paths,… packer buildReference for packer build in CI/CD: build machine images from a template non-interactively, pass variables,… packer buildWhat packer build does, how to build machine images non-interactively in CI with vars and -only, and the plug… packer fmtWhat packer fmt does, how to enforce canonical HCL2 formatting as a CI check, and how to fix a failing fmt -c… packer initWhat packer init does, how it installs required plugins for HCL2 templates in CI, and the version-constraint… packer validateReference for packer validate in CI/CD: syntax-check and validate a Packer template, including variable inter… packer validateWhat packer validate does, how to use it as a fast CI gate with vars, and the syntax and variable errors it c… pscale deploy-requestpscale branch, deploy-request, and connect manage PlanetScale schema changes. Reference for the service token… pulumi configReference for pulumi config in CI/CD: set plain and secret configuration values per stack, read them back, an… pulumi config setWhat pulumi config set does, how to set plain and secret config per stack in CI, and the passphrase and stack… pulumi destroyWhat pulumi destroy does, how to tear down a stack non-interactively in CI, and the protected-resource and st… pulumi importWhat pulumi import does, how to adopt existing cloud resources and generate code, and the resource-id and pro… pulumi loginWhat pulumi login does, how to authenticate to Pulumi Cloud or a self-managed backend in CI with tokens, and… pulumi previewReference for pulumi preview in CI/CD: see the planned create, update, and delete actions for a stack without… pulumi previewWhat pulumi preview does, how to gate PRs on a plan with JSON output and expected diffs, and the auth and dri… pulumi refreshWhat pulumi refresh does, how to reconcile stack state with real cloud resources in CI, and the drift and aut… pulumi stackReference for pulumi stack in CI/CD: select, initialize, and list stacks, and read stack outputs so later pip… pulumi stackWhat pulumi stack does, how to init, select, and read outputs for per-environment deploys in CI, and the stac… pulumi upReference for pulumi up in CI/CD: deploy a stack non-interactively with --yes, skip the preview, and authenti… pulumi upWhat pulumi up does, how to deploy non-interactively in CI with --yes and a stack, and the login and stack-se… railway up / runrailway up deploys, railway run injects service variables into a command, and railway variables lists them. R… rclone configrclone config creates and edits the remotes rclone talks to. Reference for interactive setup, non-interactive… rclone copyrclone copy transfers files to or from a configured remote without deleting anything at the destination. Refe… rclone lsd / lsfrclone lsd, lsf, and ls list buckets and objects on a remote to verify credentials and paths in CI. Reference… rclone syncrclone sync makes a destination match a source, deleting extra files at the destination. Reference for --tran… render deploys createThe Render CLI deploys create command triggers a deploy of a Render service. Reference for --wait, --output j… s5cmd cps5cmd cp uploads and downloads S3 objects far faster than aws s3 by parallelizing. Reference for --numworkers… s5cmd syncs5cmd sync mirrors a directory to or from S3 with high parallelism and optional deletion. Reference for --del… sam buildWhat sam build does, how to build SAM functions in a container for CI parity, and the runtime and dependency… sam deployWhat sam deploy does, how to deploy non-interactively in CI with --no-confirm-changeset, and the bucket and c… sam local invokeWhat sam local invoke does, how to test a Lambda locally with an event in CI, and the Docker and build errors… serverless deployReference for serverless deploy (sls deploy) in CI/CD: package and deploy a Serverless Framework service to a… serverless deployWhat serverless deploy does, how to deploy a stage non-interactively in CI, and the credentials and CloudForm… serverless invokeReference for serverless invoke (sls invoke) in CI/CD: call a deployed Lambda function with a payload to smok… serverless invokeWhat serverless invoke does, how to test deployed and local functions in CI with payloads, and the function-n… serverless removeReference for serverless remove (sls remove) in CI/CD: tear down a Serverless Framework service stack for a s… skaffold buildReference for skaffold build in CI/CD: build and push tagged images defined in skaffold.yaml and emit a build… skaffold devWhat skaffold dev does, why its file-watching loop is the wrong fit for CI, and how to use skaffold run with… skaffold runReference for skaffold run in CI/CD: build images and deploy them to a Kubernetes cluster in one pass, pinnin… skaffold runWhat skaffold run does, how to build and deploy once in CI with a profile and default-repo, and the context a… sops --encryptReference for sops --encrypt in CI/CD: encrypt secret files in place with KMS or age keys so they commit safe… sops -d (decrypt)Reference for sops -d in CI/CD: decrypt SOPS-encrypted secret files at deploy time using a KMS, age, or PGP k… sst deployReference for sst deploy in CI/CD: deploy an SST app to a named stage non-interactively with OIDC AWS credent… supabase db / functionssupabase link, db push, and functions deploy run Supabase migrations and Edge Functions from CI. Reference fo… surge deploysurge publishes a static directory to a surge.sh domain. Reference for the project path and domain args, SURG… terraform applyReference for terraform apply in CI/CD: apply a saved plan non-interactively, use -auto-approve, and cap para… terraform applyWhat terraform apply does, how to apply a saved plan non-interactively in CI, auto-approve, and the most comm… terraform consoleWhat terraform console does, how to evaluate expressions and functions interactively or piped in CI, and the… terraform destroyReference for terraform destroy in CI/CD: tear down managed infrastructure, target a subset, and clean up eph… terraform destroyWhat terraform destroy does, how to tear down infrastructure safely in CI, target a subset, and the dependenc… terraform fmtReference for terraform fmt in CI/CD: enforce canonical HCL formatting, run a -check gate across the tree, an… terraform fmtWhat terraform fmt does, how to enforce canonical formatting as a CI check, and how to fix a failing fmt -che… terraform force-unlockReference for terraform force-unlock in CI/CD: clear a stale state lock left by a crashed run, with the safet… terraform force-unlockWhat terraform force-unlock does, how to clear a stale state lock safely after a crashed CI job, and the risk… terraform getWhat terraform get does, how it installs and updates modules, how it differs from init, and the module errors… terraform graphWhat terraform graph does, how to render the dependency graph to an image in CI, and the cycle errors it help… terraform importReference for terraform import in CI/CD: bring existing infrastructure under management, use the declarative… terraform importWhat terraform import does, how to bring existing infrastructure under management, the import block, and the… terraform initReference for terraform init in CI/CD: initialize providers, modules, and the backend, pass backend-config, a… terraform initWhat terraform init does, how to use it in CI with backend config and lockfiles, plus the most common init fa… terraform loginWhat terraform login does, why CI should use a token env var instead, and the authentication errors you hit w… terraform outputReference for terraform output in CI/CD: read output values as raw or JSON to feed downstream deploy steps, e… terraform outputWhat terraform output does, how to read output values as raw or JSON for downstream CI steps, and the errors… terraform planReference for terraform plan in CI/CD: preview changes, save a plan file with -out for a later apply, and gat… terraform planWhat terraform plan does, how to save a plan file for apply in CI, detailed-exitcode for drift gates, and the… terraform providersReference for terraform providers in CI/CD: inspect the provider dependency tree and lock cross-platform chec… terraform providersWhat terraform providers shows, how to use providers lock for cross-platform CI checksums, and the errors you… terraform refreshWhat terraform refresh does, why it is now apply -refresh-only, how to reconcile drift in CI, and the errors… terraform refreshReference for terraform refresh in CI/CD: reconcile state with real infrastructure via apply -refresh-only an… terraform showReference for terraform show in CI/CD: render a saved plan or state as human-readable or JSON for policy chec… terraform showWhat terraform show does, how to render a saved plan or state as human-readable or JSON in CI, and the errors… terraform state listReference for terraform state list in CI/CD: enumerate and filter the resource addresses Terraform tracks, th… terraform state listWhat terraform state list does, how to enumerate and filter resources in state, and the state-access errors y… terraform state mvWhat terraform state mv does, how to rename or move resources in state without recreating them, and the error… terraform state rmWhat terraform state rm does, how to stop tracking a resource without destroying it, and the locking errors y… terraform state showWhat terraform state show does, how to inspect a single resource’s tracked attributes, and how to find the ex… terraform taintWhat terraform taint does, why -replace is the modern way to force recreation, and the errors you hit forcing… terraform testWhat terraform test does, how to write and run .tftest.hcl tests in CI, and the failures and version errors y… terraform untaintWhat terraform untaint does, how to clear a tainted mark so a resource is not recreated, and the errors you h… terraform validateReference for terraform validate in CI/CD: a fast, offline configuration check that runs after init and gates… terraform validateWhat terraform validate does, how to use it as a fast CI gate with JSON output, and the configuration errors… terraform versionWhat terraform version reports, how to check the CLI and provider versions in CI as JSON, and the version-con… terraform workspaceReference for terraform workspace in CI/CD: create, select, and list named workspaces for per-environment or… terraform workspaceWhat terraform workspaces do, how to create, select, and list them in CI for per-environment state, and the e… terraform-docs configA .terraform-docs.yml file pins format, sections, and output settings so every run matches. Reference for the… terraform-docs markdownterraform-docs markdown generates a table of inputs, outputs, and providers from a module. Reference for the… terraform-docs injectterraform-docs can inject generated docs between markers in a README. Reference for --output-file, --output-m… terragrunt dependencyTerragrunt dependency blocks pass one unit outputs into another and order the DAG. Reference for config_path,… terragrunt hclfmtterragrunt hclfmt rewrites terragrunt.hcl files to canonical HCL style. Reference for --check, --diff, and us… terragrunt initterragrunt init wraps terraform init, generating backend and provider config from terragrunt.hcl. Reference f… terragrunt plan/applyterragrunt plan and apply delegate to terraform after wiring backend, inputs, and dependencies. Reference for… terragrunt remote_stateTerragrunt remote_state generates a terraform backend block and can auto-create the S3 bucket and lock table.… terragrunt run-allterragrunt run-all runs a command across every unit in a tree, ordered by dependencies. Reference for run-all… terrascan scanterrascan scan checks Terraform, Kubernetes, and more against OPA/Rego policies. Reference for -i, -t, -o sar… tflint sariftflint --format=sarif emits SARIF for GitHub code scanning. Reference for generating, uploading, and the exit… tflint --inittflint --init downloads the plugins declared in .tflint.hcl before linting. Reference for the init step, GITH… tflint pluginsTFLint cloud plugins add hundreds of provider-specific rules. Reference for the plugin block, source and vers… tflint rulesTune which TFLint rules run with rule blocks and inline annotations. Reference for rule "name" {}, --only, an… tflinttflint catches invalid Terraform, deprecated syntax, and provider-specific issues. Reference for --recursive,… tfupdate providertfupdate provider rewrites provider version constraints across all .tf files. Reference for the syntax, -r re… turso dbturso db create provisions a Turso (libSQL) database and turso db shell runs SQL against it. Reference for to… vagrant provisionWhat vagrant provision does, how to re-run provisioners on a running VM, and the not-running and provisioner… vagrant upWhat vagrant up does, how to bring up a dev VM with a chosen provider, and the box and provider errors you hi… Vault AppRole authAppRole logs a CI job in with a role_id and secret_id to get a token. Reference for role setup, vault write a… vault auth enablevault auth enable turns on an auth method (approle, jwt, kubernetes, aws). Reference for -path, -type, and th… vault auth listvault auth list shows which auth methods are enabled and on what paths. Reference for -detailed, accessors, a… Vault AWS authAWS auth logs a workload in using its IAM identity via sts:GetCallerIdentity. Reference for the iam method, b… Vault OIDC from ActionsAuthenticate GitHub Actions to Vault with the workflow OIDC token, no static secret. Reference for the jwt ro… Vault Kubernetes authKubernetes auth logs a pod in with its service account JWT. Reference for the role bound_service_account_name… vault kv deletevault kv delete soft-deletes KV v2 secret versions. Reference for -versions, the difference from destroy, and… vault kv getReference for vault kv get in CI/CD: read secrets from the Vault KV engine, extract a single field, and emit… vault kv getWhat vault kv get does, how to read secrets from the KV engine in CI with -field and -format, and the auth an… vault kv listvault kv list shows the keys under a KV path. Reference for KV v2 metadata paths, -format, and the 403/404 er… vault kv metadatavault kv metadata manages KV v2 version history, max_versions, and full deletion. Reference for get/put/delet… vault kv patchvault kv patch updates individual fields of a KV v2 secret without overwriting the rest. Reference for the pa… vault kv putWhat vault kv put does, how to write secrets to the KV engine safely in CI from stdin, and the permission and… vault lease renewvault lease renew extends a dynamic secret lease and lease revoke ends it early. Reference for lease_id, -inc… vault loginReference for vault login in CI/CD: authenticate to Vault with a JWT or OIDC method instead of static tokens,… vault loginWhat vault login does, how to authenticate non-interactively in CI with AppRole or JWT/OIDC, and the auth-met… vault namespaceNamespaces partition an Enterprise/HCP Vault. Reference for VAULT_NAMESPACE, -namespace, vault namespace list… vault operator initvault operator init initializes a new Vault and emits unseal keys and the root token. Reference for -key-shar… vault operator unsealvault operator unseal submits unseal key shares to bring Vault out of the sealed state. Reference for the thr… vault pki issueThe PKI engine issues short-lived certificates on demand. Reference for pki/issue/<role>, common_name, ttl, a… vault policy listvault policy list shows all policy names and vault policy read prints one. Reference for inspecting CI access… vault policy writevault policy write creates or updates an HCL policy granting capabilities on paths. Reference for capabilitie… vault readWhat vault read does, how to read from dynamic secrets engines like database and AWS in CI, and the path and… vault secrets enablevault secrets enable mounts a secrets engine (kv, transit, pki, database). Reference for -path, -version, and… vault statusvault status reports seal state, version, and HA leadership. Reference for the exit codes (0/1/2), -format=js… vault token createvault token create issues a child token with policies, TTL, and use limits. Reference for -policy, -ttl, -use… vault token lookupvault token lookup shows a token policies, TTL, and accessor. Reference for -accessor, self vs other lookup,… vault token revokevault token revoke invalidates a token and its children. Reference for -self, -accessor, -mode=path, and revo… vault transit encryptThe transit engine encrypts and decrypts data without exposing keys. Reference for transit/encrypt, base64 pl… vault writevault write sends data to any Vault path: secrets, config, auth roles. Reference for key=value syntax, @file,… vercel --prodvercel and vercel --prod create a deployment from the Vercel CLI. Reference for --prod, --token, --yes, prebu… vercel deployReference for vercel deploy in CI/CD: build and deploy a project to a preview or production URL non-interacti… vercel envvercel env add, ls, rm, and pull manage Vercel environment variables. Reference for the production/preview/de… vercel link / buildvercel link associates a directory with a Vercel project and vercel build produces .vercel/output for prebuil… vercel pullReference for vercel pull in CI/CD: download project settings and environment variables for a target environm… wrangler d1wrangler d1 create, execute, and migrations manage Cloudflare D1 SQLite databases. Reference for --remote vs… wrangler deployReference for wrangler deploy in CI/CD: publish a Cloudflare Worker to an environment non-interactively using… wrangler deploywrangler deploy uploads a Cloudflare Worker. Reference for --env, the CLOUDFLARE_API_TOKEN and account ID, wr… wrangler deployWhat wrangler deploy does, how to deploy a Cloudflare Worker non-interactively in CI with an API token, and t… wrangler devWhat wrangler dev does, how to run a Worker locally for tests, and why it hangs in CI plus how to run it non-… wrangler kvwrangler kv namespace and kv key manage Cloudflare Workers KV. Reference for create, put, get, bulk, --bindin… wrangler publishReference for wrangler publish in CI/CD: the legacy Cloudflare Worker deploy command, now aliased to wrangler… wrangler secret putReference for wrangler secret put in CI/CD: set an encrypted secret on a Cloudflare Worker non-interactively… wrangler secret putWhat wrangler secret put does, how to set Worker secrets non-interactively in CI from stdin, and the auth and… wrangler secret putwrangler secret put stores an encrypted secret for a Cloudflare Worker. Reference for stdin piping, --env, bu… wrangler tail / devwrangler tail streams live Worker logs and wrangler dev runs a Worker locally. Reference for --format json, -… yq evalReference for yq eval in CI/CD: query and edit YAML in place to bump image tags, read values, and patch manif…

/usr/bin/time -vGNU /usr/bin/time -v reports wall time, CPU time, and maximum resident set size for a command. Reference for… ssh config host blockA ~/.ssh/config Host block stores per-host settings (HostName, User, Port, IdentityFile) so ssh and scp stay… 7z x7z x extracts archives with full paths and 7z l lists them, across .7z, zip, and more. Reference for -o outpu… 7z7z creates and extracts .7z (and other) archives via p7zip. Reference for a add, x extract, l list, -p passwo… ab (ApacheBench)ab (ApacheBench) benchmarks an HTTP endpoint. Reference for -n, -c, -k, -t, and the apr_socket_connect and "i… actact executes GitHub Actions workflows on your machine in Docker so you can test a workflow before pushing. Re… action-validatoraction-validator validates GitHub Actions workflow and action.yml files against their JSON schemas. Reference… actionlintactionlint statically lints GitHub Actions workflow YAML for syntax, expression, and shellcheck errors. Refer… adb devicesadb devices lists the emulators and phones the Android Debug Bridge can see. Reference for -l, wait-for-devic… adb installadb install pushes an APK to a device and installs it. Reference for -r, -t, -g, split APKs with install-mult… adb logcatadb logcat streams the Android system and app log. Reference for -d, -c, priority filters, --pid, and how to… adb wait-for-deviceadb wait-for-device blocks until a device reaches the device state, but not until boot completes. Reference f… add-apt-repositoryadd-apt-repository adds a PPA or third-party APT source to the system. Reference for -y, --no-update, PPAs, a… add-apt-repositoryadd-apt-repository registers a PPA or extra APT source. Reference for -y, the software-properties-common depe… age -d -iage -d decrypts an age file using an identity (private key) file. Reference for -i, -d, passphrase decryption… age -e -rage -e -r encrypts a file to one or more age recipient public keys. Reference for -r, -R, -a armor, -p passph… age-keygenage-keygen creates an X25519 age key pair. Reference for -o output, -y public-from-private, and the file-perm… alembic currentalembic current prints the revision the database is at, and alembic heads shows the latest. Reference for ver… alembic downgradealembic downgrade reverts revisions to a target or by a relative count. Reference for downgrade -1, downgrade… alembic revision --autogenalembic revision --autogenerate diffs models against the database to draft a migration. Reference for -m, the… alembic upgrade headalembic upgrade head applies all pending revisions to the latest. Reference for upgrade targets, alembic.ini/… amqp-publish / consumeamqp-publish and amqp-consume from rabbitmq-c speak AMQP directly to a broker. Reference for --exchange, --ro… amtoolamtool drives Alertmanager from the CLI. Reference for check-config, alert query, silence add, --alertmanager… apachectl -Sapachectl -S dumps the parsed virtual host configuration so you can see which vhost serves which name. Refere… apachectl configtestapachectl configtest validates the Apache httpd configuration and reports Syntax OK or the failing line. Refe… apachectl gracefulapachectl graceful reloads Apache config without dropping connections, and refuses to reload a broken config.… apk addapk add installs packages on Alpine Linux. Reference for --no-cache, --virtual, --repository, version pinning… apk add --no-cacheapk add --no-cache installs Alpine packages without leaving an index cache, keeping images small. Reference f… apk addapk add installs packages on Alpine Linux. Reference for --no-cache, virtual packages, and the "unsatisfiable… apkReference for Alpine apk: add, --no-cache, --virtual, del, and a CI example that installs build dependencies… apk delapk del removes Alpine packages, including virtual build-dep groups. Reference for deleting a --virtual group… apk updateapk update refreshes the Alpine package index and apk upgrade applies updates. Reference for update, upgrade,… apk updateapk update refreshes the Alpine package index. Reference for when it is needed, how --no-cache replaces it, a… apt-cacheapt-cache searches the package index and prints dependency and version data without installing. Reference for… apt-cacheapt-cache queries the APT package index without installing. Reference for search, show, policy, madison, and… apt-get autoremoveapt-get autoremove deletes orphaned dependencies to shrink images. Reference for --purge, what counts as orph… apt-get cleanapt-get clean and rm -rf /var/lib/apt/lists shrink Docker images after installing. Reference for the clean pa… apt-getReference for apt-get: update, install, -y, DEBIAN_FRONTEND, --no-install-recommends, and a CI example that i… apt --no-install-recommendsapt-get install --no-install-recommends skips recommended packages to shrink Docker images. Reference for the… apt-get installapt-get install adds packages non-interactively. Reference for -y, --no-install-recommends, version pinning,… apt-get installapt-get install adds Debian/Ubuntu packages non-interactively. Reference for -y, DEBIAN_FRONTEND, and the "Un… apt-get removeapt-get remove uninstalls Debian/Ubuntu packages. Reference for remove vs purge, --auto-remove, and the lefto… apt-get updateapt-get update downloads the latest package index files from the configured repositories. Reference for why i… apt-get updateapt-get update refreshes the Debian/Ubuntu package index. Reference for why it is required before install, an… apt-key (deprecated)apt-key managed APT trusted keys but is deprecated and removed in newer releases. Reference for why it warns… apt-keyReference for apt-key: add, adv, the modern signed-by keyring replacement, and a CI example that installs a r… apt-key deprecatedapt-key is deprecated; modern APT uses per-repo keyrings referenced with signed-by. Reference for the migrati… apt-markapt-mark holds a package at its current version and marks packages auto or manual. Reference for hold, unhold… arp / ip neigharp (and ip neigh) inspects the ARP/neighbor cache mapping IPs to MACs. Reference for -n, -a, ip neigh show,… artillery runartillery run drives load from a YAML scenario. Reference for -e, -o, --overrides, ensure thresholds, and the… asdf installasdf install manages many language runtimes via .tool-versions. Reference for plugins, and the "No preset ver… asdf reshimasdf dispatches commands through shims that go stale after installing tool binaries. Reference for asdf reshi… asdf pluginsasdf is a multi-language version manager driven by .tool-versions. Reference for plugin add, install, the shi… async-profilerasync-profiler samples a JVM for CPU and allocation with low overhead and can emit flame graphs. Reference fo… atlas migrate applyatlas migrate apply runs pending versioned migrations against a database. Reference for --dir, --url, --dry-r… atlas migrate diffatlas migrate diff computes a new migration from the desired schema. Reference for --to, --dev-url, atlas.sum… atlas schema applyatlas schema apply reconciles a database to a declared schema without versioned files. Reference for --to, --… atlas schema applyatlas schema apply reconciles a database to a declared schema. Reference for --url, --to, --dev-url, --auto-a… awk -Fawk -F and FS change how awk splits a line into fields: by comma, colon, tab, or a regex. Reference for CSV,… awk -vawk -v var=value injects a shell value into an awk program safely, avoiding fragile quoting. Reference for th… awk /regex/awk '/regex/{action}' runs an action only on matching lines, a grep with field access. Reference for ~, !~, a… awk $0awk $0 is the entire current line, used for grep-like printing, rewriting records, and prefixing output. Refe… awk arraysawk associative arrays key on strings, powering one-line dedup (!seen[$0]++) and grouping. Reference for the… awk average columnawk averages a numeric column with sum/NR in END, with care for skipped headers and empty input. Reference fo… awk BEGIN / ENDawk BEGIN runs before any input and END runs after all of it, perfect for headers, totals, and averages. Refe… awkawk is a pattern-scanning text processor for CI. Reference for -F field separator, -v variables, and $1/$NF f… awk count uniqueawk counts occurrences of each distinct value in a column and reports a tally, the awk version of sort | uniq… awk exitawk exit N sets the process exit status so a pipeline step can pass or fail on a parsed condition. Reference… awk FNRawk FNR resets to 1 for each input file, unlike NR. Reference for per-file numbering, the NR==FNR join idiom,… awk gsub / subawk gsub replaces all regex matches and sub replaces the first, in $0 or a field. Reference for stripping uni… awk lengthawk length returns the character count of a string, $0, or a field, useful for filtering long lines. Referenc… awk match / substrawk match finds a regex and substr slices a string, together pulling a token out of a field. Reference for RS… awk && and ||awk combines conditions with && and || to filter on several columns at once. Reference for compound patterns,… awk nextawk next stops processing the current line and moves to the next record, used to skip headers, comments, or m… awk NFawk NF holds the number of fields on the current line. Reference for printing the last field, filtering by co… awk NRawk NR is the running record number across all input. Reference for numbering lines, printing a specific line… awk skip headerawk NR>1 skips a header row and NR==1 keeps only the header, essential when parsing CSV and tool tables. Refe… awk numeric filterawk filters rows by numeric comparison on a column, like $3 > 10 or $5 >= 0.9. Reference for the operators an… awk OFS / ORSawk OFS and ORS control how fields and records are joined on output: convert spaces to tabs, CSV to TSV, or c… awk print $Nawk '{print $N}' pulls a single column out of whitespace-separated output. Reference for $1..$NF, $0, multipl… awk printfawk printf formats output with width, precision, and alignment, unlike print. Reference for %s, %d, %.2f, %-1… awk rangesawk /start/,/end/ selects every line from a start match through an end match, ideal for extracting a section… awk splitawk split(str, arr, sep) divides a string into an array on a separator, for parsing nested fields. Reference… awk sum columnawk '{sum+=$N} END{print sum}' totals a numeric column from tool output. Reference for summing sizes, counts,… awkawk is a pattern-scanning text-processing language. Reference for -F, fields, print, -v, and the field-splitt… aws get-secret-valueaws secretsmanager get-secret-value retrieves a secret string from AWS Secrets Manager. Reference for --secre… aws sns publishaws sns publish sends a message to an SNS topic (or LocalStack). Reference for --topic-arn, --message, --mess… aws sqs (CLI)aws sqs create-queue, send-message, and receive-message drive Amazon SQS (or LocalStack) from CI. Reference f… az keyvault secret showaz keyvault secret show retrieves a secret value from Azure Key Vault. Reference for --vault-name, --name, --… az pipelinesaz pipelines (Azure CLI DevOps extension) manages Azure Pipelines and can preview a YAML pipeline via the run… b2sumb2sum computes and verifies fast BLAKE2 checksums with -c. Reference for -l length, --check, FAILED output, a… base64base64 encodes and decodes data for transporting secrets in CI. Reference for -d, -w0, and stdin usage, plus… base64base64 encodes and decodes data in Base64. Reference for -d, -w0, GNU vs BSD flags, and the "invalid input" w… basename / dirnamebasename and dirname split a path into filename and directory in CI. Reference for suffix stripping and the s… bat (cat clone)bat is a cat clone with syntax highlighting and git integration. Reference for --plain, --paging=never, --col… bat -r / -dbat -r prints a line range and bat -d shows git-modified lines, useful for quoting code in CI logs. Reference… benchstatbenchstat computes the mean and confidence of Go benchmark results and compares two sets to flag regressions.… berglas execberglas exec resolves berglas:// references in the environment and runs a command with the decrypted secrets.… blackboxStackExchange blackbox encrypts files in a repo with GPG and decrypts them on demand. Reference for postdeplo… brew bundlebrew bundle installs every dependency listed in a Brewfile. Reference for install, --file, check, cleanup, an… brew bundlebrew bundle installs everything listed in a Brewfile. Reference for --file, --no-lock, brew bundle check, and… brewReference for Homebrew brew: install, --cask, bundle, HOMEBREW_NO_AUTO_UPDATE, and a CI example that installs… brew installbrew install adds packages via Homebrew on macOS and Linux runners. Reference for HOMEBREW_NO_AUTO_UPDATE, --… brew installbrew install adds packages via Homebrew on macOS/Linux runners. Reference for formulae, casks, and the slow-u… brotlibrotli compresses to .br, tuned for web assets, with quality up to 11. Reference for -q 11, -d, -c, -o output… BSD vs GNU grepmacOS ships BSD grep, which lacks -P and differs from GNU grep on Linux runners. Reference for the portabilit… buildkite pipeline uploadbuildkite-agent pipeline upload parses and uploads a Buildkite pipeline; --dry-run validates without uploadin… bundle installbundle install resolves and installs gems from a Gemfile. Reference for --deployment, --frozen, --path, and t… bunzip2bunzip2 decompresses .bz2 files, the inverse of bzip2. Reference for -k keep, -c stdout, -t test, and the not… bw getbw get retrieves a password or item from the Bitwarden vault for scripting. Reference for object types, --ses… bw syncbw sync pulls the latest vault data from the Bitwarden server into the local cache. Reference for --last, the… bw unlockbw unlock decrypts the Bitwarden vault and returns a session key needed by other bw commands. Reference for -… bzcatbzcat decompresses .bz2 files to stdout without writing a file, the bzip2 counterpart to zcat. Reference for… bzip2bzip2 compresses files to .bz2 with the Burrows-Wheeler algorithm. Reference for -9, -k, -c, -d, and the comp… caddy fmtcaddy fmt formats a Caddyfile to the canonical style and can gate on formatting in CI. Reference for --overwr… caddy reloadcaddy reload pushes a new config to a running Caddy via the admin API with zero downtime. Reference for --con… caddy runcaddy run starts Caddy in the foreground, ideal for containers and CI smoke tests. Reference for --config, --… caddy validatecaddy validate adapts and validates a Caddyfile or JSON config without starting the server. Reference for --a… cargo flamegraphcargo-flamegraph builds a Rust binary and produces a flame graph in one step, wrapping perf or dtrace. Refere… catcat concatenates and prints files and writes here-docs. Reference for -n, -A, heredocs, and the "No such file… certbot (nginx)certbot issues Let's Encrypt certificates for nginx and supports a dry run for CI. Reference for certonly, --… certbotcertbot obtains and renews Let's Encrypt TLS certificates. Reference for certonly, --webroot, --dns-*, and th… certutilcertutil decodes base64 secrets and hashes files on Windows without extra tools. Reference for -decode, -enco… cfssl gencertcfssl gencert generates keys and certificates from JSON configs. Reference for -initca, -ca, -config, -profil… cfssljsoncfssljson turns cfssl JSON output into separate .pem files. Reference for -bare, -f, stdin input, and the mis… chamber execchamber exec loads secrets from AWS SSM Parameter Store into the environment and runs a command. Reference fo… chamber readchamber read prints a single secret from AWS SSM by service and key. Reference for --quiet, version history,… cuDNN versionHow to read the installed cuDNN version from the header or via the framework. Reference for cudnn_version.h,… checkov (Actions)checkov scans GitHub Actions workflows for security misconfigurations with its github_actions framework. Refe… chmodchmod changes file permissions in CI. Reference for +x, octal modes, -R, and symbolic modes, plus the 600-on-… chmodchmod changes file permission bits. Reference for +x, numeric modes, -R, and the "Permission denied" execute-… choco installchoco install adds Windows packages in CI. Reference for -y, --no-progress, --version, exit code 3010 (reboot… chownchown changes a file owner and group. Reference for user:group, -R, --reference, and the "Operation not permi… circleci config processcircleci config process expands orbs, parameters, and pipeline values into a single resolved CircleCI config.… circleci config validatecircleci config validate checks a .circleci/config.yml against the CircleCI schema from the CLI. Reference fo… circleci local executecircleci local execute runs a single CircleCI job on your machine in Docker to test config before pushing. Re… cksumcksum prints a CRC checksum and byte count for fast change detection. Reference for its output format, the PO… clickhouse-client --formatclickhouse-client --format and the FORMAT clause control how results print: JSON, CSV, TSV, Pretty. Reference… clickhouse-client --multiqueryclickhouse-client --multiquery runs several semicolon-separated ClickHouse statements, ideal for migration fi… clickhouse-client --queryclickhouse-client --query runs a single SQL statement against ClickHouse non-interactively. Reference for --q… clickhouse-clientclickhouse-client is the ClickHouse command-line client. Reference for --host, --query, --multiquery, FORMAT,… ClickHouse native vs HTTPWhen to use clickhouse-client (native TCP 9000) versus the HTTP interface (curl on 8123) in CI. Reference for… clinfoclinfo lists OpenCL platforms and devices across vendors. Reference for the summary flags and the "Number of… cmakecmake configures and builds C/C++ projects across toolchains. Reference for -S/-B, --build, -D, and the "coul… cmpcmp compares two files byte by byte and reports the first difference, ideal for binary files. Reference for -… cockroach sqlcockroach sql connects to a CockroachDB cluster and runs SQL. Reference for --url, --insecure, -e, --file, an… cockroach sqlcockroach sql is the CockroachDB SQL client. Reference for --url, --insecure, --certs-dir, -e, and the TLS an… colordiffcolordiff wraps diff to colorize added and removed lines, making CI logs and code review easier to scan. Refe… column -tcolumn -t aligns whitespace- or delimiter-separated data into a neat table. Reference for -t, -s, and the uti… commcomm shows lines unique to each of two sorted files and lines they share. Reference for -1/-2/-3, the must-be… commcomm reports lines unique to each of two sorted files and lines common to both. Reference for -1, -2, -3, --c… compress (.Z)compress and uncompress handle the legacy .Z (LZW) format still seen in Unix vendor packages. Reference for -… Compress-ArchiveCompress-Archive zips files and folders in PowerShell without external tools. Reference for -Path, -Destinati… conda env createconda env create builds an environment from environment.yml. Reference for -f, -n, --prefix, and the "prefix… conda installconda install adds packages into a conda environment. Reference for -n, -c, -y, and the slow-solver and "Pack… confdconfd renders config templates from etcd, Consul, or env backends. Reference for -onetime, -backend env, -con… consul-templateconsul-template renders Go templates from Consul KV and Vault secrets. Reference for -template, -once, -dry,… corepack enablecorepack enable activates Yarn and pnpm shims that ship with Node. Reference for the packageManager field and… corepack preparecorepack prepare downloads and pins an exact Yarn/pnpm version. Reference for --activate, offline caching, an… cpcp copies files and directories in CI for staging artifacts. Reference for -r, -p, -a, and trailing-slash beh… cpiocpio bundles files into a stream archive, used in initramfs and RPM payloads. Reference for -o create, -i ext… cqlsh -ecqlsh -e runs a single CQL statement against Cassandra non-interactively. Reference for -e, host/port args, c… cqlsh -fcqlsh -f runs a .cql schema or migration file against Cassandra. Reference for -f, SOURCE, exit behaviour, an… cqlsh keyspaceCreate and select a Cassandra keyspace from cqlsh for tests. Reference for CREATE KEYSPACE, replication optio… cqlshcqlsh is the Cassandra CQL shell. Reference for -e, -f, -u, -p, --cqlversion, and the "Connection refused" an… createdbReference for createdb: -h, -U, -O, -E, -T, idempotent creation, and a CI example that creates a fresh Postgr… createdbcreatedb creates a new PostgreSQL database from the shell, a common CI setup step. Reference for -O, -T, -E,… createdbcreatedb creates a new PostgreSQL database from the shell. Reference for -h, -U, -O, -E, -T, and the "already… Criterion.rsCriterion.rs is a statistics-driven Rust benchmarking harness that detects regressions across runs. Reference… csplitcsplit splits a file into pieces at line numbers or regex matches, unlike split which cuts by size. Reference… csvcutcsvcut from csvkit selects, reorders and inspects CSV columns by name or index. Reference for -c, -n, -C, and… csvjsoncsvjson from csvkit converts CSV to JSON, with array, line and GeoJSON output. Reference for -i, --stream, -k… csvsqlcsvsql from csvkit runs SQL queries directly against CSV files via an in-memory database. Reference for --que… csvstatcsvstat from csvkit prints per-column types, nulls, ranges and frequencies for a CSV. Reference for --mean, -… in2csvin2csv from csvkit converts XLSX, XLS, JSON and fixed-width files to CSV. Reference for -f, --sheet, and the… csvqcsvq runs SQL SELECT, JOIN, and UPDATE statements directly on CSV and TSV files. Reference for -f, --without-… cuda-gdbcuda-gdb is the CUDA-aware GNU debugger for stepping through GPU kernels. Reference for building with -g -G,… cue exportcue export evaluates CUE and emits concrete JSON or YAML. Reference for --out, -e, -t, and the conflicting va… cue fmtcue fmt rewrites CUE files to canonical style. Reference for gating CI with a format check, exit behavior, an… cue vetcue vet checks data files against a CUE schema before you render. Reference for -d, -c, --schema, and the con… curl --cacert / --certcurl --cacert trusts a specific CA bundle and --cert presents a client certificate for mutual TLS. Reference… curl --compressedcurl --compressed asks the server for gzip/brotli and transparently decompresses the response. Reference for… curl --fail-with-bodycurl --fail-with-body returns a non-zero exit code on HTTP errors like plain --fail, but still prints the res… curl --jsoncurl --json sends a JSON body and sets both Content-Type and Accept to application/json in one flag. Referenc… curl --max-time / --connect-timeoutcurl --max-time caps the whole transfer and --connect-timeout caps the connection phase. Reference for keepin… curl --resolvecurl --resolve maps a hostname and port to a specific IP without editing /etc/hosts. Reference for testing a… curl --resolvecurl --resolve pins a hostname to an IP, bypassing DNS for a request. Reference for --resolve, --connect-to,… curl --retry-all-errorscurl --retry-all-errors makes --retry apply to every error, not just timeouts and 5xx. Reference for what it… curl --retrycurl --retry re-attempts failed transfers with backoff. Reference for --retry-delay, --retry-max-time, --retr… curl -A / --user-agentcurl -A sets the User-Agent header. Reference for APIs that require a User-Agent (like GitHub), identifying y… curl -b / -ccurl -b sends cookies and -c saves them to a jar. Reference for session-based APIs in CI: logging in, persist… curl -d / --datacurl -d sends a request body and implies POST. Reference for --data, --data-raw, --data-binary, and reading a… curl -f / --failcurl -f makes curl return a non-zero exit code on HTTP responses of 400 and above, so a failed request actual… curl -G / --data-urlencodecurl -G turns -d data into a GET query string and --data-urlencode encodes each value safely. Reference for b… curl -H / --headercurl -H adds or overrides HTTP request headers like Content-Type, Accept, and Authorization. Reference for re… curl -I / --headcurl -I sends a HEAD request and prints only the response headers. Reference for lightweight health checks, c… curl -k / --insecurecurl -k disables TLS certificate verification. Reference for why it is dangerous in CI, the real fixes with -… curl -L / --locationcurl -L follows HTTP 3xx redirects to the final URL. Reference for why downloads and CDN links need it, limit… curl -o / -Ocurl -o writes the response to a named file and -O uses the remote filename. Reference for downloading artifa… curl -s / -S / -sScurl -s silences the progress meter and errors, -S re-enables error messages, and the -sS combo gives you cle… curl -T / -Fcurl -T uploads a file with PUT and -F sends multipart form data. Reference for uploading artifacts and posti… curl -u / --usercurl -u sends HTTP basic auth credentials as user:password. Reference for the user-only form, netrc, and why… curl -v / --verbosecurl -v prints the request and response headers and the TLS handshake so you can debug failing API calls in C… curl -w / --write-outcurl -w prints variables like http_code and time_total after a transfer. Reference for capturing the status i… curl -X / --requestcurl -X sets the HTTP request method like POST, PUT, PATCH, or DELETE. Reference for when you need it, when c… curl bearer tokenHow to send a bearer token with curl using the Authorization header, including the curl 7.61+ --oauth2-bearer… curlcurl transfers data over HTTP(S) in CI scripts. Reference for -f, -sS, -L, -o, and --retry so downloads fail… curl release assetA CI pattern for downloading a GitHub release asset with curl, covering the latest/download URL, following re… curl | jqPiping curl into jq extracts and checks fields from an API response in CI. Reference for the pattern, -e exit… POST JSON with curlA reference pattern for posting JSON to an API in CI with curl: setting the content type, sending the body, f… curl wait-until-ready loopA CI pattern for waiting until a service is healthy with curl: poll an endpoint until it returns 200, with a… curl smoke testcurl -fsS turns an HTTP response into a pass/fail exit code, the core of a CI smoke test. Reference for -f, -… curlcurl transfers data to and from a server over HTTP(S) and other protocols. Reference for -f, -sSL, -o, retrie… curliecurlie is a frontend that takes curl arguments but prints HTTPie-style colorized output. Reference for its sy… cut -ccut -c extracts characters by position rather than by field. Reference for -c ranges, fixed-width data, and t… cut -fcut -f extracts delimited fields from each line. Reference for -f, -d, field ranges, and the tab-default and… cutcut extracts columns by field or character in CI. Reference for -f, -d, and -c, plus the single-delimiter and… cutcut extracts columns from each line by field or byte. Reference for -f, -d, -c, --complement, and the "single… cwebpcwebp encodes PNG/JPEG to WebP with lossy or lossless modes. Reference for -q, -lossless, -resize, and the co… dasel putdasel put sets or deletes values in JSON, YAML, TOML and XML. Reference for put types, -t, the v2 `dasel put`… dasel querydasel selects values from JSON, YAML, TOML, XML and CSV with one query syntax. Reference for selectors, -r/-w… datedate formats and computes timestamps in CI for tags and filenames. Reference for +FORMAT, -u UTC, and epoch s… datedate prints or formats the current time and does date math. Reference for +FORMAT, -u, -d, ISO 8601, and the… dbmate statusdbmate status lists applied and pending migrations. Reference for --exit-code to gate CI on pending work and… dbmate updbmate up creates the database if needed and applies pending migrations. Reference for DATABASE_URL, dbmate m… dcgmidcgmi runs NVIDIA Data Center GPU Manager health checks and diagnostics. Reference for discovery, diag levels… dddd copies and converts bytes block by block for fixtures, truncation, and byte extraction. Reference for bs,… DEBIAN_FRONTENDDEBIAN_FRONTEND=noninteractive makes apt and dpkg skip interactive prompts. Reference for setting it correctl… deltadelta (git-delta) is a syntax-highlighting pager for git diff with line numbers and side-by-side view. Refere… delta (diff viewer)delta is a syntax-highlighting pager for git diffs with side-by-side view and line numbers. Reference for the… ssh deploy to VPSA full pattern for deploying to a VPS over SSH from GitHub Actions: key as a secret, known_hosts via ssh-keys… deviceQuerydeviceQuery is the CUDA sample that prints device properties and confirms the runtime works. Reference for bu… dfReference for df: -h, -i, -T, --output, the disk-full diagnosis use, and a CI example that checks free space… dfdf reports filesystem disk space usage. Reference for -h, -i, -T, and diagnosing "No space left on device" (E… dhall formatdhall format canonicalizes Dhall source and --check gates CI. Reference for --check, --inplace, and the parse… dhall-to-jsondhall-to-json evaluates a typed Dhall expression to JSON. Reference for --file, --compact, --preserve-null, a… dhall-to-yamldhall-to-yaml evaluates a typed Dhall expression to YAML. Reference for --file, --output, --documents, and th… diff --exit-codediff exits 1 when files differ, which makes it a one-line gate to fail CI when generated files, lockfiles, or… diff -rdiff -r walks two directory trees and reports every file that differs or is missing. Reference for -r, -q, --… diff -udiff -u prints a unified diff between two files, the format patch and git understand. Reference for -u, -c, c… diff3diff3 compares three files against a common ancestor and can produce a merged result with conflict markers. R… diffstatdiffstat reads a diff and prints a per-file summary of inserted, deleted, and modified lines. Reference for -… difftasticdifftastic (difft) diffs by syntax tree instead of by line, so reformatting and moved code show as no change.… dig +shortdig +short prints only the answer values, ideal for capturing an address in a CI script. Reference for combin… dig +tracedig +trace resolves a name from the root servers down, exposing where delegation or an authoritative server b… digReference for dig: +short, record types, @server, +trace, and a CI example that resolves a hostname to verify… digdig queries DNS with full control over record type and resolver, the standard tool for debugging name resolut… digdig queries DNS records. Reference for +short, record types, @server, +trace, and the NXDOMAIN/SERVFAIL and "… direnv export / execdirenv export and direnv exec load an .envrc without an interactive shell hook, the right way to use direnv i… direnv (load env)direnv loads and unloads environment variables based on the current directory via .envrc. Reference for diren… dmesg (OOM)dmesg shows kernel ring-buffer messages, including OOM-killer kills behind exit 137. Reference for -T, greppi… dnf clean alldnf clean all purges cached metadata and packages to shrink images. Reference for the flag, the cache directo… dnfReference for dnf: install, -y, --setopt=install_weak_deps, remove, clean all, and a CI example that installs… dnf installdnf install adds packages on Fedora, RHEL, and derivatives. Reference for -y, --setopt=install_weak_deps=Fals… dnf installdnf install adds packages on Fedora/RHEL/Rocky. Reference for -y, groups, module streams, and the "No match f… dnf makecachednf makecache downloads and builds the repository metadata cache ahead of install. Reference for makecache, -… dnf removednf remove uninstalls packages on Fedora/RHEL and prunes orphans. Reference for autoremove, -y, and the depen… docker HEALTHCHECKA Docker HEALTHCHECK marks a web server container healthy only when it serves requests. Reference for HEALTHC… docker run --gpusdocker run --gpus all gives a container access to the host GPUs. Reference for --gpus syntax, device selectio… dockerizedockerize waits for dependencies and templates config at container start. Reference for -wait, -timeout, -tem… doppler rundoppler run fetches your Doppler config secrets and runs a command with them in the environment. Reference fo… doppler secrets downloaddoppler secrets download writes a config's secrets to a JSON or env file. Reference for --format, --no-file,… dotnet (Windows)dotnet build/test/publish on Windows runners. Reference for -c Release, -r runtime, --self-contained, and the… dpkg -idpkg -i installs a .deb file directly, bypassing the repository. Reference for -i, dependency resolution with… dpkg -idpkg -i installs a local .deb file directly. Reference for -i, dependency-resolution gaps, and the "dependenc… dpkg -ldpkg -l lists installed packages and dpkg -L lists a package's files. Reference for -l, -L, -s, --get-selecti… dpkgReference for dpkg: -i, -r, -l, -L, -S, --configure, and a CI example that installs a local .deb and fixes de… dpkg-querydpkg-query inspects installed Debian packages. Reference for -W, -L, -s, --show formats, and the "no packages… dropdbdropdb removes a PostgreSQL database from the shell, useful for resetting test state. Reference for --if-exis… dropdbdropdb deletes a PostgreSQL database from the shell. Reference for -h, -U, --if-exists, -f, and the "being ac… dsqdsq runs SQL against JSON, CSV, TSV, Excel, and Parquet files by loading them into an embedded engine. Refere… duReference for du: -h, -s, -d, -x, --exclude, sorting biggest directories, and a CI example that finds what is… dudu estimates per-directory disk usage. Reference for -h, -s, -d, --max-depth, and using it to find what fille… duckdb (files)The DuckDB CLI runs SQL directly over CSV, JSON, and Parquet files with read_csv/read_json. Reference for -c,… duckdb CLIduckdb is the DuckDB analytical CLI. Reference for -c, .read, read_csv_auto, COPY, and the file-lock and out-… dyffdyff diffs YAML and JSON by structure with human-readable paths, ideal for Kubernetes manifests. Reference fo… entrentr runs an arbitrary command when files given on stdin change. Reference for -c, -r, -d, the find/fd piping… entrentr runs a command when files (fed on stdin) change. Reference for -r, -c, -d, -p, and the "no regular files… env / printenvenv lists environment variables and runs a command with a modified environment. Reference for reading masked… envenv prints the environment or runs a command with a modified one. Reference for -i, VAR=val, shebang use, and… envsubstenvsubst substitutes environment variables into templates in CI. Reference for variable lists and the over-su… envsubstReference for envsubst: substituting environment variables into text, restricting to a SHELL-FORMAT list, and… envsubstenvsubst replaces $VAR and ${VAR} references in a template with environment values. Reference for limiting th… envsubstenvsubst replaces $VAR and ${VAR} in a template with environment values. Reference for restricting variables,… envsubstenvsubst substitutes environment variables into text templates. Reference for variable lists, stdin/stdout us… envtplenvtpl renders Jinja2 templates using only environment variables. Reference for --allow-missing, stdin/stdout… etcdctletcdctl is the etcd key-value client. Reference for ETCDCTL_API, --endpoints, put/get/del, and the "context d… ethtoolethtool queries and tunes NIC settings (link, speed, offloads). Reference for -i, -S, -k, link detection, and… exiftool stripexiftool -all= removes all metadata from images and PDFs. Reference for -all=, -overwrite_original, the _orig… exiftool readexiftool reads EXIF, IPTC, XMP, and other metadata from images and documents. Reference for tag selection, -j… Expand-ArchiveExpand-Archive extracts a .zip in PowerShell with no external tools. Reference for -Path, -DestinationPath, -… expandexpand converts tabs to spaces to satisfy linters and normalize diffs. Reference for -t, -i, --tabs lists, an… expectexpect scripts answer interactive prompts (passwords, confirmations) for tools that demand a TTY. Reference f… exportexport marks shell variables for child-process environments. Reference for export VAR, -p, -n, and the "not e… external-secrets kubectlExternal Secrets Operator turns an ExternalSecret CR into a native Kubernetes Secret from a backend. Referenc… grep fail on matchMake a CI step fail when a forbidden pattern appears in logs or code, using grep exit codes correctly. Refere… fd -e / -xfd -e filters by file extension and fd -x runs a command per result. Reference for -e, -x, -X, the {} placeho… fd (find files)fd is a user-friendly alternative to find that searches by regex and respects .gitignore. Reference for the b… ffmpeg transcodeffmpeg -i transcodes audio and video between codecs and containers. Reference for -c:v, -c:a, -crf, -preset,… ffmpeg framesffmpeg extracts still frames or a single thumbnail from a video using -ss, -frames:v, and -vf. Reference for… ffmpeg audioffmpeg extracts or converts the audio track from a video with -vn and -c:a. Reference for copying vs re-encod… ffmpeg concatffmpeg joins multiple clips with the concat demuxer or concat filter. Reference for -f concat, the file list… find -deletefind -delete removes the files it matches without a separate rm. Reference for placement, -depth, the directo… find -emptyfind -empty matches zero-byte files and empty directories, useful for cleaning stray build output. Reference… find -exec +find -exec CMD {} + passes many matches to one command invocation, far faster than \;. Reference for the + te… find -execfind -exec runs a command on matched files. Reference for the {} placeholder, the \; vs + terminators, and th… find -inamefind -iname matches file names ignoring case. Reference for when to prefer it over -name and the portability… find -maxdepthfind -maxdepth and -mindepth bound the directory depth of a search. Reference for -maxdepth 1, -mindepth, opt… find -mminfind -mmin selects files by modification age in minutes, finer than -mtime. Reference for +N, -N, and using i… find -mtimefind -mtime selects files by modification age in days, the core of cache pruning. Reference for +N, -N, exact… find -namefind -name matches files by a glob pattern on the base name. Reference for quoting, wildcards, and the patter… find -newerfind -newer matches files modified more recently than a reference file. Reference for -newer, -newermt, touch… find operatorsfind combines predicates with -and, -or, -not (!), and parentheses. Reference for operator precedence, groupi… find -pathfind -path matches a glob against the entire path, not just the base name. Reference for -wholename, -ipath,… find -permfind -perm matches files by permission mode, useful for auditing executables and world-writable files. Refere… find -printfind -print writes each match on its own line, the default action. Reference for -print, -ls, and how the def… find -print0find -print0 separates results with NUL bytes so xargs -0 handles any file name. Reference for -print0, xargs… find -printffind -printf prints custom fields like size, time, and path for each match. Reference for the format directiv… find -prunefind -prune stops find from descending into directories like node_modules or .git. Reference for the -prune -… find -regexfind -regex matches the whole path against a regular expression. Reference for -iregex, -regextype, and the f… find -sizefind -size selects files by size, the fast way to hunt large files when a runner hits disk-full. Reference fo… find symlinksfind -type l finds symbolic links, and -L makes find follow them. Reference for -L, -xtype, broken-link detec… find -typefind -type restricts matches to files (f), directories (d), or symlinks (l). Reference for the type letters a… find | xargsfind piped to xargs runs a batched command over matches. Reference for the xargs pattern, its whitespace pitf… findfind walks directory trees and acts on matching files in CI. Reference for -name, -type, -exec, and -print0,… find with grepCombine find to select files and grep to search their contents, a core CI lint and audit pattern. Reference f… find clean artifactsUse find to remove build artifacts like *.o, __pycache__, and coverage files between CI runs. Reference for c… find disk fullWhen a runner reports no space left, find locates the biggest and newest files fast. Reference for -size, -pr… findfind walks directory trees and acts on matching files. Reference for -name, -type, -exec, -print0, and the "m… fiofio benchmarks storage I/O. Reference for --rw, --bs, --iodepth, --runtime, job files, and the "no space" and… xargs arg list too longxargs splits a huge argument list into chunks to defeat the "argument list too long" error from the shell. Re… FlameGraphBrendan Gregg FlameGraph scripts fold stack samples and render a flame graph SVG. Reference for stackcollapse… flyway cleanflyway clean drops every object in the configured schemas, resetting a database for tests. Reference for clea… flyway infoflyway info prints the state of every migration: pending, applied, or failed. Reference for reading migration… flyway migrateflyway migrate applies all pending versioned migrations to a database. Reference for -url, -user, -password,… flyway repairflyway repair removes failed migration entries and realigns checksums in the schema history table. Reference… flyway validateflyway validate checks applied migrations against the files on disk and fails on checksum mismatch. Reference… fmtfmt reflows paragraphs to a target width for changelogs, commit bodies, and generated docs. Reference for -w,… fnm usefnm use switches Node.js versions with the fast Rust-based fnm. Reference for --use-on-cd, eval "$(fnm env)",… free -mfree -m shows total, used, free, and available memory. Reference for why "available" matters more than "free"… freeReference for free: -h, -m, -s, the available-vs-free distinction, and a CI example that checks memory headro… freefree shows memory and swap usage. Reference for -h, -m, -s, the available vs free column, and diagnosing OOM-… fx (scriptable)fx explores JSON interactively and, in scripts, applies JavaScript reducers to transform it. Reference for th… fxfx is a JSON viewer and processor usable non-interactively with anonymous functions. Reference for fx .field,… fzf --filterfzf is an interactive fuzzy finder, but --filter makes it usable in scripts and CI. Reference for --filter, -… gawk vs mawk vs BSDawk on Linux, Alpine, and macOS runners is gawk, mawk, or BSD awk, with real behavior differences. Reference… gcloud secrets accessgcloud secrets versions access reads a secret payload from Google Secret Manager. Reference for the version a… gem installgem install adds a Ruby gem globally. Reference for --no-document, -v, and the native-extension build and "pe… Get-ChildItemGet-ChildItem (alias ls/dir/gci) lists files and recurses directories in PowerShell. Reference for -Recurse,… getentReference for getent: hosts, passwd, group, the NSS-aware lookup advantage, and a CI example that resolves a… getent hostsgetent hosts resolves a name through nsswitch, including /etc/hosts, exactly as an application would. Referen… getent hostsgetent queries NSS databases, so getent hosts resolves a name exactly as the runner will, including /etc/host… getent hostsgetent hosts resolves names via the full NSS stack (/etc/hosts + DNS). Reference for hosts/ahosts and the res… getentgetent queries NSS databases like hosts, passwd, and group. Reference for hosts, ahosts, and passwd lookups,… gh workflowgh workflow (GitHub CLI) lists, views, enables, and manually runs GitHub Actions workflows. Reference for the… gs compress PDFGhostscript (gs) compresses PDFs by downsampling images via -dPDFSETTINGS. Reference for the device/preset fl… gs merge PDFGhostscript (gs) merges multiple PDFs into one and extracts page ranges with pdfwrite. Reference for the merg… git diff --exit-codegit diff --exit-code exits 1 when there are changes, the standard way to fail CI if generated files, lockfile… git diff --no-indexgit diff --no-index compares two arbitrary files or directories using Git's diff engine, even outside a repos… git-crypt statusgit-crypt status reports which files are encrypted, plaintext, or unencrypted-but-should-be. Reference for -e… git-crypt unlockgit-crypt unlock decrypts the encrypted files in a repository using a GPG key or symmetric key file. Referenc… Actions artifact zipThe GitHub Actions upload-artifact action compresses uploads into a zip automatically, so manual zipping is o… GitLab CI Lint APIThe GitLab CI Lint REST API validates a .gitlab-ci.yml server-side; call it with curl when glab is unavailabl… glab ci lintglab ci lint validates a .gitlab-ci.yml against the GitLab CI Lint API from the terminal. Reference for the g… parallel joblog/pipeGNU parallel --joblog records per-job exit codes, --retries re-runs failures, and --pipe splits stdin into ch… GNU parallelGNU parallel runs commands concurrently from a list of arguments. Reference for :::, --jobs, {}, --halt, and… GNU vs BSD tarGNU tar (Linux) and BSD tar (macOS) differ in flags and defaults. Reference for the gaps plus the unknown-opt… GNU vs BSD findGNU find (Linux) and BSD find (macOS) differ on -printf, -regextype, -delete, and option order. Reference for… GNUPGHOME in CIGNUPGHOME points GnuPG at an isolated, ephemeral home directory in CI. Reference for the chmod 700 requiremen… go test -benchgo test -bench runs Go benchmark functions and -benchmem adds allocation stats. Reference for -bench, -benchm… go tool pprofgo tool pprof reads Go CPU, heap, and block profiles and serves an interactive web UI with -http. Reference f… gojqgojq is a pure-Go jq implementation with stricter errors and added builtins. Reference for shared flags, the… gomplategomplate renders Go templates with datasources (env, files, vault, HTTP). Reference for -f, -o, -d, --context… goose downgoose down reverts the most recently applied migration, and down-to reverts to a version. Reference for goose… goose statusgoose status lists each migration with its applied timestamp or Pending. Reference for reading goose migratio… goose upgoose up applies all pending migrations from a directory for a given driver. Reference for the driver/dsn arg… gopass showgopass show retrieves a secret from the gopass password store for scripting. Reference for -o, -f, --password… gopass syncgopass sync synchronizes the Git-backed store with its remotes and updates GPG recipients. Reference for --st… gpg --batchgpg --batch, --yes, --pinentry-mode loopback, and --passphrase-fd make GnuPG fully non-interactive. Reference… gpg --clearsigngpg --clearsign wraps a readable text message in an inline signature. Reference for clear-signing manifests a… gpg apt keyringgpg --dearmor converts an armored repo key into the keyring file apt signed-by expects. Reference for the mod… gpg --dearmorgpg --dearmor converts an ASCII-armored repo key into the binary keyring APT expects. Reference for importing… gpg --decryptgpg --decrypt recovers an encrypted file using a secret key or passphrase. Reference for --output, loopback p… gpg --delete-secret-keysgpg --delete-secret-keys removes private keys from the keyring after a job. Reference for deleting by fingerp… gpg --detach-signgpg --detach-sign (-b) writes a separate .sig or .asc signature file for an artifact. Reference for --armor,… gpg --encryptgpg --encrypt -r encrypts a file to one or more recipients public keys. Reference for --recipient, --armor, s… gpg --exportgpg --export and --export-secret-keys write keys out for storage in a CI secret. Reference for --armor, key s… gpg --fingerprintgpg --fingerprint prints the full fingerprint of a key for verification and pinning. Reference for confirming… gpg --gen-keygpg --gen-key and --full-generate-key create new keypairs. Reference for the interactive flow and the unatten… gpg --importgpg --import loads a public or secret key into the keyring from a file or stdin. Reference for importing a ke… gpg --list-keysgpg --list-keys and --list-secret-keys show the keys in your keyring. Reference for --with-colons machine out… gpg --recv-keysgpg --keyserver --recv-keys imports a public key by ID from a keyserver. Reference for --keyserver-options, f… gpg --signgpg --sign (-s) creates a signed, compressed message bundling the data and signature. Reference for inline si… gpg trustgpg owner trust and --trust-model always control the "key is not certified" warning and the encrypt trust pro… gpg --verifygpg --verify checks a detached or inline signature against the signed data and the signer key. Reference for… gpg vs gpg2gpg, gpg2, the gpg-agent, and pinentry differ between GnuPG 1.x and 2.x. Reference for which binary you have… GPG_TTYGPG_TTY tells gpg-agent which terminal to use for pinentry. Reference for the "Inappropriate ioctl for device… gpg-agentgpg-agent handles passphrases and key access for GnuPG 2.x. Reference for allow-loopback-pinentry, gpgconf re… gpustatgpustat prints a compact one-line-per-GPU status with utilization, memory, and processes. Reference for the f… grafana-cligrafana-cli manages Grafana plugins and admin tasks. Reference for plugins install/update, --pluginsDir, and… grep --colorgrep --color highlights matched text with ANSI codes; --color=always forces it through pipes. Reference for c… grep --includegrep --include, --exclude, and --exclude-dir scope a recursive search by glob, skipping node_modules and .git… grep -A / -B / -Cgrep -A, -B, and -C print lines after, before, and around each match for log context in CI. Reference for con… grep -cgrep -c counts matching lines instead of printing them, useful for threshold checks in CI. Reference for -c,… grep -Egrep -E enables extended regex so +, ?, {n}, |, and () work without backslashes. Reference for -E vs basic re… grep -egrep -e supplies multiple patterns, matching a line if any one hits. Reference for -e, patterns starting with… grep -Fgrep -F treats the pattern as a literal string, not a regex, avoiding metacharacter surprises. Reference for… grep -fgrep -f reads patterns from a file, one per line, to match against many terms at once. Reference for -f, deny… grep -igrep -i matches regardless of letter case, useful when log levels vary. Reference for -i behavior, combining… grep -l / -Lgrep -l lists filenames that contain a match; -L lists files with no match. Reference for -l, -L, and using t… xargs with grep -lPipe grep -l (filenames with matches) into xargs to edit or process every file that contains a pattern. Refer… grep -mgrep -m N stops after N matches, speeding up checks on huge logs. Reference for -m, early exit, and combining… grep -ngrep -n prefixes each match with its line number, helping pinpoint findings in CI logs. Reference for -n, -H… grep -ogrep -o prints only the matched substring, not the whole line, ideal for extracting values in CI. Reference f… grep -Pgrep -P enables PCRE with lookahead, lookbehind, \d, and non-greedy quantifiers. Reference for -P features an… grep -qgrep -q sets only the exit code and prints nothing, ideal for if-tests and assertions in CI. Reference for -q… grep -rgrep -r searches a directory tree for a pattern; -R follows symlinks. Reference for -r vs -R, performance, an… grep -vgrep -v prints lines that do NOT match, used to filter noise from logs in CI. Reference for -v, chaining excl… grep -w / -xgrep -w matches whole words and -x matches whole lines, avoiding partial-match false positives. Reference for… grep -zgrep -z treats input as NUL-separated records and -a forces text mode on binary. Reference for -z, -a, -I, an… grep anchorsgrep anchors ^ and $ pin matches to line start and end; character classes match sets. Reference for ^, $, [..… grepgrep searches text for matching lines in CI. Reference for -r, -E, -i, -q, and -v, plus the exit-code-1-means… grep exit codesgrep exits 0 on a match, 1 on no match, and 2 on error. Reference for why a no-match grep fails set -e steps… grep + find + xargsPairing grep with find and xargs scales searches and scopes them precisely in CI. Reference for -print0, xarg… grep basicsgrep searches its input for lines matching a pattern and prints them. Reference for basic usage, stdin piping… grepgrep searches text for lines matching a pattern. Reference for -r, -E, -i, -q, -v, and the exit-code-1-means-… gron --ungrongron --ungron reassembles JSON from gron assignment lines, so you can grep then rebuild. Reference for the gr… gron (grep edit)gron flattens JSON into greppable assignment lines and ungron rebuilds it, so you can find and edit deep valu… grongron flattens JSON into discrete assignment lines so grep, diff and awk work on it. Reference for usage, --st… grpcurl -d callgrpcurl -d sends a JSON request to a gRPC method and prints the response. Reference for -d, metadata headers,… grpcurl describegrpcurl describe prints the schema of a gRPC service, method, or message type. Reference for describe usage,… grpcurl listgrpcurl list enumerates gRPC services and methods over server reflection. Reference for -plaintext, list usag… grpcurlgrpcurl is curl for gRPC services. Reference for -plaintext, -d, -import-path, list/describe, and the reflect… gunzipgunzip decompresses .gz files, the inverse of gzip. Reference for -k keep, -c stdout, -t test, and the not-in… gzipgzip compresses single files with DEFLATE in CI. Reference for -d, -k, -c, and compression levels, plus the t… gzipgzip compresses a file to .gz using DEFLATE. Reference for -9 max compression, -k keep, -c stdout, -d decompr… gzipgzip compresses single files with DEFLATE. Reference for -d, -k, -c, levels, and the "not in gzip format" and… haproxy -chaproxy -c -f validates an HAProxy configuration without starting it. Reference for -c, -f, -V, and the ALERT… haproxy -vvhaproxy -vv prints the version, build options, and available features so you can confirm a keyword or feature… hcl2jsonhcl2json converts Terraform and other HCL files to JSON so you can query them with jq. Reference for usage, s… head -nhead -n prints the first N lines of input. Reference for -n, the negative -n form, multiple files, and the SI… headhead prints the first lines or bytes of input in CI. Reference for -n, -c, and negative counts, plus the SIGP… headhead prints the first lines or bytes of input. Reference for -n, -c, negative counts, and the SIGPIPE/exit-14… heaptrackheaptrack records every allocation with a stack trace at far lower overhead than Massif, then analyzes it wit… hexdumphexdump prints file bytes in configurable formats, including the canonical -C view. Reference for -C, -v, -n,… heyhey is a modern HTTP load generator (ApacheBench replacement). Reference for -n, -c, -z, -m, and the connecti… hosthost resolves names to addresses (and back) with a compact one-line output. Reference for record types, speci… hosthost is a simple DNS lookup utility. Reference for -t, -a, reverse lookups, specifying a server, and the NXDO… hostnamehostname shows and sets the system hostname and resolves its IP. Reference for -f, -i, -I, and the "Name or s… actions/cache internalsGitHub actions/cache tars the cached paths and compresses with zstd or gzip. Reference for the internals plus… htmlqhtmlq extracts elements, text and attributes from HTML using CSS selectors. Reference for --text, --attribute… htmlq (CI usage)htmlq applies CSS selectors to HTML and pulls text or attributes, jq-style for HTML. Reference for --text, --… http (HTTPie)HTTPie (http) is a human-friendly HTTP client. Reference for --check-status, -b, --json, headers, and the exi… httpd -thttpd -t is the raw Apache binary config test used on RHEL and container images. Reference for -t, -D defines… httpie --authHTTPie --auth and --auth-type add Basic, Digest, or Bearer authentication to a request. Reference for user:pa… httpie --check-statusHTTPie --check-status makes the exit code reflect the HTTP status so 4xx and 5xx fail the build. Reference fo… httpie --downloadHTTPie --download saves the response body to a file with a progress bar, like a wget mode for HTTPie. Referen… httpie --ignore-stdinHTTPie --ignore-stdin prevents HTTPie from reading redirected stdin as a request body, the fix for jobs that… httpie --sessionHTTPie --session persists headers, auth, and cookies across requests so multi-step API flows stay logged in.… HTTPie (http)HTTPie (the http command) makes API requests with a clean syntax and JSON by default. Reference for the field… http GETHTTPie http GET issues a GET request with a human-friendly syntax and colorized output. Reference for URL par… http POSTHTTPie http POST builds a JSON body from field items using =, :=, and == operators. Reference for typed field… https commandHTTPie ships an https command that defaults to TLS, plus --verify to control certificate checking. Reference… hurl --testhurl --test runs one or more .hurl files as tests, reporting pass/fail and setting the exit code. Reference f… hurl --variablehurl --variable and --variables-file inject values into {{placeholders}} in a Hurl file, so one file runs aga… hurl captures/assertsHurl [Captures] extract values from a response and [Asserts] verify them, enabling multi-step API tests. Refe… hurlhurl runs one or more HTTP requests defined in a .hurl file and can chain them. Reference for invoking hurl,… hyperfine JSON gatehyperfine --export-json writes machine-readable timings you can parse to fail CI on regressions. Reference fo… hyperfinehyperfine is a command-line benchmarking tool that runs a command many times and reports mean and stddev with… hyperfinehyperfine is a command-line benchmarking tool that runs a command repeatedly and reports mean and standard de… hyperfinehyperfine is a command-line benchmarking tool. Reference for --warmup, --runs, --export-json, -N, and the "co… icaclsicacls grants, removes, and resets NTFS permissions. Reference for /grant, /remove, /inheritance, /reset, /T,… icdifficdiff shows two files side by side with color and highlights the changed characters within a line. Reference… iconviconv converts a file between character encodings such as latin1 and utf-8. Reference for -f, -t, //TRANSLIT,… idid prints the current user, group, and supplementary groups, including UID/GID. Reference for debugging permi… ifconfigifconfig shows and configures interfaces (legacy net-tools). Reference for the address read, up/down, and the… ImageMagick resizeImageMagick -resize and -thumbnail scale images with geometry strings. Reference for geometry flags (!, ^, >)… ImageMagick PDF policyImageMagick blocks PDF/PS by default via policy.xml, raising "not authorized". Reference for the policy.xml P… ImageMagick convertImageMagick convert (magick) changes image formats and applies operations. Reference for input/output formats… infisical runinfisical run fetches a project environment's secrets and runs a command with them injected. Reference for --… influx bucketinflux bucket create makes an InfluxDB 2.x bucket with a retention period. Reference for create, list, delete… influx queryinflux query runs a Flux query against InfluxDB 2.x and prints the result. Reference for --org, --file, --raw… influx setupinflux setup performs the one-time InfluxDB 2.x initialization: org, user, bucket, and token. Reference for -… influx writeinflux write loads line-protocol data into an InfluxDB 2.x bucket. Reference for --bucket, --org, --precision… influx CLIinflux is the InfluxDB command-line client. Reference for the v2 -t/-o/--host flags, query, write, and the un… Invoke-WebRequestInvoke-WebRequest downloads files and calls HTTP APIs in PowerShell. Reference for -OutFile, -UseBasicParsing… ip addrip addr shows the interfaces and IP addresses on a runner or container. Reference for ip addr show, link stat… ip addrip addr shows and configures network interface addresses. Reference for show, add, del, scope, and the "Devic… ip linkip link manages network interfaces (up/down, MTU, MAC). Reference for show, set up, mtu, and the "Operation n… ip routeip route shows the routing table and default gateway, revealing why traffic to a host has no path. Reference… ip routeip route inspects and edits the kernel routing table. Reference for show, add, default, get, and the "Network… iperf3iperf3 measures network bandwidth between two hosts. Reference for -s, -c, -u, -t, -P, and the "Connection re… iptablesiptables configures Linux netfilter firewall rules. Reference for -L, -A, -I, -j, NAT, and the permission and… wget preinstalledwget is on many but not all CI images, and minimal containers often omit it. Reference for checking availabil… j2cli (j2)j2cli exposes the j2 command to render Jinja2 templates from env, json, yaml, or ini data. Reference for form… jaegerjaeger-all-in-one runs a full tracing backend for tests. Reference for collector/OTLP ports, --query.base-pat… jaqjaq is a jq-compatible JSON processor in Rust that is faster and stricter. Reference for jq-shared flags, beh… jcjc parses the output of commands like df, ps, dig and ls into JSON. Reference for jc --command, magic syntax,… jc (CI usage)jc converts the output of dozens of commands (ps, dig, ls, df) into JSON for reliable parsing in CI. Referenc… jd (json diff)jd diffs two JSON files by structure, ignoring key order and formatting, and can emit a patch. Reference for… jellojello queries JSON using Python instead of the jq language, exposing the data as the variable _. Reference fo… jinja2-clijinja2-cli renders a Jinja2 template against a data file (yaml/json/ini/env). Reference for format flags, str… jlessjless is a pager for JSON and YAML that folds, searches, and navigates large documents. Reference for --mode,… jnvjnv is an interactive TUI for building and previewing jq filters against a JSON file. Reference for flags, th… jojo constructs JSON objects and arrays from key=value shell arguments. Reference for nested objects, -a arrays… jo (JSON builder)jo constructs JSON from key=value pairs on the command line, the inverse of jq. Reference for typed values, n… joinjoin merges two sorted files on a shared key field, like a SQL join. Reference for -1/-2, -t, -a, and the sor… journalctl -bjournalctl -b shows logs from the current boot and -k shows kernel messages. Reference for finding OOM kills… journalctl -ujournalctl -u <unit> prints the systemd journal for one service. Reference for -u, -f, -n, --since, and the p… journalctlReference for journalctl: -u, -f, --since, -n, -p, -b, and a CI example that dumps a failing service unit log… jpegoptimjpegoptim optimizes JPEGs losslessly or to a target quality/size. Reference for --max, --strip-all, --size, i… jq --argjq --arg binds a string and --argjson binds parsed JSON into a variable. Reference for safely injecting CI va… jq -cThe jq -c / --compact-output flag prints each result on one line. Reference for writing JSON to $GITHUB_OUTPU… jq -eThe jq -e / --exit-status flag sets the exit code from the last output. Reference for gating CI steps on a JS… jq -nThe jq -n / --null-input flag starts with null instead of reading input. Reference for constructing JSON from… jq -rThe jq -r / --raw-output flag prints strings without surrounding quotes. Reference for feeding gh api strings… jq -RThe jq -R / --raw-input flag reads each input line as a JSON string instead of parsing JSON. Reference for tu… jq -sThe jq -s / --slurp flag reads all inputs into a single array. Reference for combining paginated gh api pages… jq .[]The jq .[] operator streams each element of an array or each value of an object. Reference for iterating gh a… jq @base64jq @base64 and @base64d encode and decode base64 inside a filter. Reference for handling gh api content field… jq @csvjq @csv and @tsv turn an array into a CSV or TSV row with correct quoting. Reference for exporting gh api dat… jq @jsonjq @json and tojson serialize a value into a JSON string; fromjson parses one. Reference for embedding JSON i… jq @shjq @sh quotes values so they are safe to eval in a shell. Reference for turning gh api JSON into shell argume… jq // operatorjq a // b yields b when a is null, false, or produces no output. Reference for defaulting missing gh api fiel… jq addjq add reduces an array by summing numbers, concatenating strings/arrays, or merging objects. Reference for a… jq ascii_downcasejq ascii_downcase and ascii_upcase change string case. Reference for normalizing gh api labels and branch nam… jqjq is the command-line JSON processor for CI. Reference for -r raw output, -e exit status, --arg, and filters… jq del()jq del(path) removes keys or array elements at the given path. Reference for stripping fields from gh api JSO… jq group_byjq group_by(.field) partitions an array into sub-arrays sharing a key value. Reference for bucketing gh api r… jq gsubjq gsub replaces all regex matches and sub replaces the first. Reference for cleaning version strings and ref… jq has()jq has("key") returns true when an object contains a key or an array has an index. Reference for guarding opt… jq keysjq keys returns a sorted array of an object keys (or array indices). Reference for inspecting gh api JSON sha… jq lengthjq length returns array size, object key count, or string length. Reference for counting gh api results in CI… jq map()jq map(f) applies a filter to each element of an array and returns a new array. Reference for reshaping gh ap… jq {} and []jq builds new objects with {k: .v} and arrays with [ ... ]. Reference for reshaping gh api JSON into a matrix… jq select()jq select(condition) keeps only the inputs where the condition is true. Reference for filtering gh api arrays… jq sort_byjq sort_by(.field) orders an array and min_by/max_by pick the extreme element. Reference for ordering gh api… jq split / joinjq split(sep) breaks a string into an array, join(sep) merges one, and ltrimstr/rtrimstr strip a known prefix… jq test()jq test(re) returns true when a string matches a regex. Reference for filtering gh api items by pattern in CI… jq to_entriesjq to_entries converts an object into {key,value} pairs and from_entries rebuilds it. Reference for looping a… jq uniquejq unique and unique_by(f) remove duplicate array elements, optionally by a key. Reference for deduping gh ap… jq walk()jq walk(f) transforms every value depth-first, while paths and getpath address deep fields. Reference for cle… jqjq is a command-line JSON processor. Reference for -r, -e, filters, --arg, and the parse errors and "null" su… jsonnetjsonnet evaluates a data templating language into JSON. Reference for -y, -m, --ext-str, --tla-str, and the R… jsonnetfmtjsonnetfmt formats jsonnet source and can gate CI with a diff check. Reference for --test, -i, --string-style… jtbljtbl turns an array of JSON objects into an aligned table for readable CI logs. Reference for -n, -m, -c flag… k6 runk6 run executes load tests from JS scripts. Reference for --vus, --duration, thresholds, and the exit-code-99… kafka-configskafka-configs.sh views and changes topic and broker configs. Reference for --describe, --alter --add-config,… kafka-console-consumerkafka-console-consumer.sh reads messages from a Kafka topic to stdout. Reference for --from-beginning, --max-… kafka-console-producerkafka-console-producer.sh writes stdin lines to a Kafka topic. Reference for --bootstrap-server, --property k… kafka-consumer-groupskafka-consumer-groups.sh inspects and resets consumer group offsets and lag. Reference for --describe, --rese… kafka-topics --createkafka-topics.sh --create makes a Kafka topic with a partition and replication count. Reference for --bootstra… kafka-topics --describekafka-topics.sh --list and --describe inspect topics, partitions, and leaders. Reference for --bootstrap-serv… kcat -Lkcat -L prints Kafka cluster metadata: brokers, topics, partitions, and leaders. Reference for using -L as a… kcat -P / -Ckcat (formerly kafkacat) produces with -P and consumes with -C against Kafka. Reference for -b, -t, -e, -o, a… keepalived -tkeepalived -t parses keepalived.conf and reports config errors without starting the daemon. Reference for -t,… kill signalskill sends signals to processes; SIGTERM asks, SIGKILL forces. Reference for the signal numbers, graceful shu… killkill sends signals to processes. Reference for -TERM, -KILL, -9, signal numbers, and the "No such process" an… knex migrate:latestknex migrate:latest runs all pending migrations for a Knex environment. Reference for --env, --knexfile, and… knex migrate:rollbackknex migrate:rollback reverts the last batch of migrations, or --all to revert everything. Reference for roll… known_hosts in CIA guide to populating known_hosts in pipelines so SSH stays verified and non-interactive. Reference for ssh-k… kubesealkubeseal encrypts a Kubernetes Secret into a SealedSecret you can safely commit. Reference for --format, --ce… ldconfigldconfig rebuilds the shared library cache so newly installed .so files are found at runtime. Reference for l… ldconfigldconfig rebuilds the shared-library cache so the loader finds new .so files. Reference for -p, conf.d, and t… lddldd lists the shared libraries a binary needs and flags missing ones. Reference for resolving "error while lo… lddldd lists the shared libraries a binary needs. Reference for reading its output, diagnosing "not found" deps,… lighttpd -tlighttpd -t checks a lighttpd configuration for syntax errors before starting. Reference for -t, -tt, -f, and… liquibase rollbackliquibase rollback reverts changesets to a tag, count, or date. Reference for rollback, rollbackCount, rollba… liquibase statusliquibase status lists changesets not yet applied to the database. Reference for --verbose, using status as a… liquibase updateliquibase update applies all pending changesets from a changelog. Reference for --changelog-file, --url, --us… liquibase updateSQLliquibase updateSQL prints the SQL that update would execute, without applying it. Reference for reviewing mi… litestreamlitestream replicates and restores SQLite databases to object storage. Reference for replicate, restore, -con… ln -sln -s creates symbolic links in CI for toolchains and shared paths. Reference for -s, -f, -n, and -r, plus th… lnln creates hard and symbolic links. Reference for -s, -f, -n, relative targets, and the "File exists" and dan… logcli (Loki)logcli queries Grafana Loki with LogQL. Reference for query, --addr, --limit, --since, instant-query, and the… lsof -ilsof -i maps network ports to the process and PID holding them. Reference for -i:PORT, -nP, and resolving "ad… lsof -plsof -p <pid> lists every file, socket, and pipe a process holds open. Reference for chasing fd leaks and "to… lsofReference for lsof: -i, -P, -n, -p, -t, the port-and-file-owner use, and a CI example that finds which proces… ltraceltrace traces dynamic library calls (and optionally syscalls) a program makes. Reference for -c, -f, -e, and… lz4lz4 compresses to .lz4 with extreme speed and modest ratio, ideal for hot caches. Reference for -9, -d, -c, -… lzmalzma compresses to the older .lzma format from xz-utils. Reference for -9, -d, -k, unlzma, lzcat, and when to… magick vs convertImageMagick 7 introduced the magick command and deprecated convert. Reference for the differences, the policy… makemake builds targets from a Makefile by dependency rules. Reference for -j, -C, -f, and the "missing separator… mamba installmamba install is a fast, drop-in conda replacement. Reference for -n, -c, and the solver-speed wins plus the… mariadb clientThe mariadb client connects to MariaDB and MySQL servers, mirroring the mysql client. Reference for -h, -u, -… massif-visualizermassif-visualizer opens a massif.out file in a GUI to explore heap usage graphically. Reference for its role… md5summd5sum computes and verifies MD5 checksums with -c. Reference for -c, --check, the two-space format, FAILED o… mega-linter-runnermega-linter-runner runs MegaLinter, an aggregator of many linters including CI-config linters, in Docker. Ref… microdnf installmicrodnf is the tiny dnf for Red Hat UBI minimal images. Reference for install, clean all, --nodocs, and the… migrate downThe golang-migrate CLI migrate down reverts migrations using the .down.sql files. Reference for down N, down… migrate forceThe golang-migrate CLI migrate force sets the version and clears the dirty flag after a failed migration. Ref… migrate upThe golang-migrate CLI migrate -path -database up applies pending migrations. Reference for -path, -database,… migrate versionThe golang-migrate CLI migrate version prints the current migration version and whether the database is dirty… mlr stats1Miller stats1 and count-distinct aggregate CSV/JSON records. Reference for mlr stats1 -a -f -g, group-by, and… mlr convertMiller converts between CSV, TSV, JSON, NIDX and pretty tables with format flags. Reference for --c2j, --icsv… mlr cut/filterMiller (mlr) processes CSV, TSV and JSON as named records. Reference for mlr --csv cut and filter, the verb c… minisign -Gminisign -G generates a minisign key pair for signing releases. Reference for -G, -W unencrypted, -p/-s paths… minisign -Sminisign -S signs a file and writes a .minisig signature. Reference for -S, -m, -s, -t trusted comment, and t… minisign -Vminisign -V verifies a .minisig signature against a public key. Reference for -V, -p, -P inline key, -x, and… mise trustmise refuses untrusted config files and offers shims or activation. Reference for mise trust, mise install, s… mkcertmkcert makes locally trusted development certificates. Reference for mkcert -install, generating localhost ce… mkdir -pmkdir -p creates directory trees idempotently in CI. Reference for -p, -m, and parent creation, plus why -p n… mktempmktemp creates unique temp files and directories safely in CI. Reference for -d, templates, and -t, plus the… mktempmktemp safely creates unique temp files and directories. Reference for -d, -t, templates, trap cleanup, and t… mongodumpReference for mongodump: --uri, --db, --collection, --gzip, --archive, and a CI example that exports a MongoD… mongodumpmongodump exports a MongoDB database to BSON. Reference for --uri, --db, --collection, --gzip, --archive, and… mongoexportmongoexport exports MongoDB documents to JSON or CSV. Reference for --collection, --type, --fields, --query,… mongoimportmongoimport loads JSON, CSV, or TSV fixtures into a MongoDB collection. Reference for --jsonArray, --type, --… mongorestoremongorestore loads a BSON dump back into MongoDB. Reference for --uri, --drop, --archive, --gzip, --nsInclude… mongosh --evalmongosh --eval runs a single JavaScript expression against MongoDB without an interactive shell. Reference fo… mongosh --filemongosh --file runs a .js migration or seed script against MongoDB. Reference for --file, positional script a… mongoshReference for mongosh: the connection string, --eval, --quiet, authSource, and a CI example that pings a Mong… mongosh URIHow to build a MongoDB connection string for mongosh in CI: hosts, auth, authSource, replica sets, and direct… mongoshmongosh is the modern MongoDB shell. Reference for the connection string, --eval, --quiet, authSource, and th… mongostatmongostat reports live MongoDB server statistics. Reference for --uri, the interval/count args, --discover, a… mosquitto_pub / submosquitto_pub and mosquitto_sub publish and subscribe to MQTT topics. Reference for -h, -t, -m, -q QoS, -C, a… mount / findmntmount and findmnt list mounted filesystems, their types, and options. Reference for spotting a full or read-o… ms_printms_print turns a massif.out file into a text heap graph and a table of top allocators. Reference for reading… msbuildmsbuild builds .sln and project files. Reference for /p: properties, /m parallel, /t: targets, /restore, and… mtrmtr continuously probes every hop to a host, showing packet loss and latency per hop. Reference for --report,… mtrmtr combines ping and traceroute for path diagnostics. Reference for -r, -c, -w, -T, -P, and the "report mode… mustache / moThe mustache CLI and the pure-Bash mo render logic-less {{tags}} from data. Reference for data input, section… mvmv moves or renames files in CI for atomic artifact swaps. Reference for -f, -n, -t, and cross-filesystem beh… myclimycli is an enhanced MySQL/MariaDB client with autocomplete. Reference for the connection flags, -e, --csv, a… mysql --executemysql --execute (-e) runs one SQL statement non-interactively. Reference for -e, -N, -B, --batch, and the quo… mysql importLoad a SQL dump or migration into MySQL by piping it into the mysql client. Reference for redirection, --forc… mysqlReference for the mysql client: -h, -u, -p, -P, -e, MYSQL_PWD, forcing TCP, and a CI example that loads a sch… mysql_upgrademysql_upgrade upgrades system tables after a MySQL/MariaDB version bump. Reference for --force, --upgrade-sys… mysqlThe mysql client connects to MySQL and runs SQL from the shell. Reference for -h, -u, -p, -e, MYSQL_PWD, and… mysqlmysql is the MySQL/MariaDB command-line client. Reference for -h, -u, -p, -P, MYSQL_PWD, and the "Access deni… mysqladminReference for mysqladmin: ping, status, create, --wait, --silent, and a CI wait loop that blocks until a MySQ… mysqladmin pingmysqladmin ping checks whether a MySQL server is alive, the standard readiness gate before migrations. Refere… mysqladminmysqladmin administers a MySQL/MariaDB server from the shell. Reference for ping, status, create, --wait, and… mysqlcheckmysqlcheck checks, repairs, and optimizes MySQL/MariaDB tables. Reference for -c, -r, -o, -a, --all-databases… mysqldumpReference for mysqldump: --single-transaction, --databases, --no-data, --routines, and a CI example that expo… mysqldumpmysqldump exports a MySQL database to a SQL file. Reference for --single-transaction, --no-data, --databases,… mysqldumpmysqldump exports MySQL/MariaDB databases to SQL. Reference for --databases, --single-transaction, --no-data,… nats benchnats bench runs a publish/subscribe throughput benchmark against a NATS server. Reference for --pub, --sub, -… nats pub / subThe nats CLI pub and sub commands publish and subscribe to NATS subjects. Reference for -s server, --count, a… nats streamnats stream add/ls/info manages JetStream streams for durable NATS messaging. Reference for subjects, retenti… nc -z port checknc -z is the canonical TCP port-readiness check in CI. Reference for -z, -w, -v, the OpenBSD-vs-traditional n… nc -znc -z tests whether a TCP or UDP port is open without sending data. Reference for -z, -v, -w, and the connect… nc (netcat)Reference for nc/netcat: -z, -v, -w, -l, the port-probe pattern, and a CI example that waits for a TCP port t… nc (netcat)nc (netcat) reads and writes TCP/UDP connections. Reference for -z, -v, -l, -w, -u, and the port-wait idiom p… nc bannernc opens a raw TCP connection to send requests and read responses, useful for banner grabbing and protocol pr… ncatncat is Nmap's modern netcat with TLS and exec. Reference for -l, -k, --ssl, -e, -z, and the listener and por… ncompressncompress is the package that provides compress and uncompress on Linux for the legacy .Z (LZW) format. Refer… ncuncu (Nsight Compute) profiles individual CUDA kernels with detailed hardware metrics. Reference for -k, -s/-c… netstatReference for netstat: -tlnp, -an, -r, the deprecation in favor of ss, and a CI example that checks whether a… netstatnetstat lists sockets, routes, and interface stats (legacy net-tools). Reference for -tlnp, -r, -i, and the "… newman runnewman run executes a Postman collection from the command line, running its requests and tests. Reference for… newman runnewman run executes Postman collections in CI. Reference for -e, -g, --reporters, --bail, and the exit-code-1… nft (nftables)nft is the nftables CLI that supersedes iptables. Reference for list ruleset, add table/chain/rule, and the s… nginx -s reloadnginx -s reload sends a signal to reload config with zero downtime. Reference for the stop, quit, reopen sign… nginx -Tnginx -T tests the config and prints the fully resolved configuration including all includes. Reference for d… nginx -tnginx -t parses and tests the nginx configuration without starting the server. Reference for -c, -q, -p, and… nix-shellnix-shell drops you into an environment with exact pinned tools. Reference for -p, shell.nix, --run, nix deve… nmapnmap scans a host for open ports and distinguishes closed from filtered, clarifying whether a CI connection i… nmapnmap scans hosts and ports. Reference for -p, -sT, -sV, -Pn, --open, and the "host seems down" and privilege… nprocnproc prints the number of usable CPUs, which drives parallel build and test concurrency. Reference for --all… npxnpx runs a package binary without a global install. Reference for --yes, --no-install, and the install prompt… nslookupReference for nslookup: querying A/MX/TXT records, specifying a server, the dig comparison, and a CI example… nslookupnslookup queries DNS and is preinstalled on many images where dig is not. Reference for type, specifying a se… nslookupnslookup queries DNS interactively or in batch. Reference for type=, server, and the "non-authoritative" outp… nsys profilensys profile records a system-wide timeline of CUDA API, kernels, and CPU activity. Reference for -o, --stats… nuget.exenuget.exe restores packages and pushes .nupkg to a feed. Reference for restore, push, -ApiKey, -Source, -Skip… numfmtnumfmt converts numbers to and from human-readable units (KiB, MB) for size gates in CI. Reference for --to,… nvcc --versionnvcc --version prints the installed CUDA Toolkit compiler version. Reference for reading it, how it differs f… nvcc -archnvcc -arch and -gencode set the GPU compute capability to compile for. Reference for sm_XX values, fatbin bui… nvcc (compile)nvcc compiles .cu CUDA source into executables and libraries. Reference for -o, -c, -I/-L, -Xcompiler, and th… nvidia-container-clinvidia-container-cli is the low-level tool that mounts GPUs into containers. Reference for info and list, and… nvidia-ctk runtimenvidia-ctk runtime configure wires the NVIDIA Container Toolkit into Docker so containers can use GPUs. Refer… nvidia-smi --gpu-resetnvidia-smi --gpu-reset reinitializes a GPU stuck in a bad state. Reference for -i targeting, why processes mu… nvidia-smi --query-gpunvidia-smi --query-gpu with --format=csv prints named GPU fields for scripting. Reference for the field names… nvidia-smi -Lnvidia-smi -L lists each GPU with its index, name, and UUID. Reference for pinning GPUs by UUID and the empty… nvidia-smi dmonnvidia-smi dmon streams one line of GPU metrics per sample, ideal for logging utilization during a CI job. Re… nvidia-smi toponvidia-smi topo -m prints the GPU-to-GPU interconnect matrix (NVLink, PCIe, NUMA). Reference for reading the… nvidia-sminvidia-smi reports GPU model, driver, CUDA version, memory, and utilization. Reference for the plain command,… nvitopnvitop is an htop-like interactive GPU/process monitor. Reference for its monitor and one-shot modes, and usi… nvm installnvm install downloads and installs a Node.js version. Reference for .nvmrc, --lts, and the "nvm: command not… nvm usenvm use switches the active Node.js version in the current shell. Reference for .nvmrc, and the per-step shel… octoscanoctoscan is a static vulnerability scanner for GitHub Actions workflows focused on injection and dangerous ch… odod (octal dump) dumps a file in octal, hex, or ASCII to reveal hidden bytes. Reference for -c, -A, -t x1z, an… op injectop inject substitutes op:// references inside a template file with resolved secret values. Reference for -i,… op readop read resolves a 1Password secret reference to its value for use in scripts. Reference for secret-reference… op runop run resolves secret references in an env file and runs a command with them injected, without writing plain… openresty -topenresty -t validates an OpenResty (nginx + Lua) configuration, including Lua directives. Reference for -t,… OpenSSL legacy providerOpenSSL 3.0 moved old algorithms to the legacy provider. Reference for the error:0308010C unsupported error a… opensslopenssl handles certs, hashing, and encryption in CI. Reference for dgst, rand, x509, and s_client, plus comm… openssl dgst -signopenssl dgst -sign and -verify produce and check digital signatures with a private/public key. Reference for… openssl dgstopenssl dgst computes message digests and HMACs. Reference for -sha256, -hmac, -binary, and the format differ… openssl ecopenssl ec reads and re-emits elliptic-curve private and public keys. Reference for -pubout, -text, -conv_for… openssl ecparamopenssl ecparam lists curves and generates EC keys the classic way. Reference for -list_curves, -name, -genke… openssl enc -base64openssl enc -base64 encodes and decodes base64 without external tools. Reference for -base64, -d, -A, and the… openssl enc (encrypt)openssl enc encrypts and decrypts files with a symmetric cipher. Reference for -aes-256-cbc, -pbkdf2, -salt,… openssl genpkeyopenssl genpkey is the modern, algorithm-agnostic way to generate private keys (RSA, EC, Ed25519). Reference… openssl genrsaopenssl genrsa generates an RSA private key. Reference for key size, output file, and optional encryption, pl… openssl pkcs12openssl pkcs12 packs a key and cert chain into a .p12/.pfx and unpacks them back. Reference for -export, -in,… openssl pkeyopenssl pkey is the algorithm-agnostic key tool for RSA, EC, and Ed25519. Reference for -pubout, -text, -chec… openssl randopenssl rand emits cryptographically random bytes for secrets and IDs. Reference for -hex, -base64, byte coun… openssl req -x509openssl req -x509 creates a self-signed certificate in one command, ideal for tests. Reference for -newkey, -… openssl req (CSR)openssl req creates a certificate signing request (CSR) from a key. Reference for -new, -subj, -key, -addext… openssl rsaopenssl rsa inspects, encrypts, decrypts, and re-formats RSA keys. Reference for -check, -pubout, -text, pass… openssl rsa convertopenssl rsa and pkcs8 convert RSA keys between PEM/DER and PKCS#1/PKCS#8. Reference for -outform, -traditiona… openssl s_clientopenssl s_client opens a TLS connection to debug certificates, SNI, and protocol versions. Reference for -con… openssl s_clientopenssl s_client opens a TLS connection to inspect certs and handshakes. Reference for -connect, -servername,… openssl s_serveropenssl s_server starts a minimal TLS server for tests. Reference for -cert, -key, -accept, -www, and the bin… openssl verifyopenssl verify checks a certificate against a trust chain. Reference for -CAfile, -untrusted, -purpose, and t… openssl fingerprintopenssl x509 -fingerprint prints a certificate fingerprint for pinning and comparison. Reference for -sha256,… openssl x509 -reqopenssl x509 -req signs a CSR with a CA key to issue a certificate. Reference for -CA, -CAkey, -CAcreateseria… openssl x509 (inspect)openssl x509 -text -noout prints a human-readable view of a certificate: subject, issuer, SANs, validity. Ref… openssl expiry checkopenssl x509 -checkend and -enddate test whether a certificate is expired or about to expire. Reference for s… openssl x509 convertopenssl x509 converts certificates between PEM and DER. Reference for -inform, -outform, and the encoding err… opensslopenssl is a toolkit for TLS, certificates, hashing, and encryption. Reference for s_client, x509, genrsa, en… optipngoptipng losslessly shrinks PNG files by recompressing them. Reference for -o levels, -strip all, in-place beh… otel-cliotel-cli emits OpenTelemetry spans from the shell. Reference for span, exec, --endpoint, traceparent propagat… pacman -Spacman -S installs packages on Arch Linux. Reference for --noconfirm, --needed, keyring init, and the "target… pacman -Spacman -S installs packages on Arch Linux. Reference for -Sy, -Syu, --noconfirm, and the partial-upgrade and… pacman -Syupacman -Syu refreshes the database and upgrades all packages on Arch. Reference for why partial upgrades brea… pandoc to PDFpandoc converts Markdown to PDF via a LaTeX or HTML PDF engine. Reference for --pdf-engine, the "pdflatex not… pandoc HTML/docxpandoc converts Markdown to standalone HTML and Word docx. Reference for -s, --reference-doc, -t, and the for… pass insertpass insert adds or updates an entry in the pass store. Reference for -m multiline, -e echo, -f force, and th… pass showpass show reads a secret from the pass password store. Reference for pass show, -c clip, line selection, and… paste -dpaste joins lines from multiple files side by side with a chosen delimiter. Reference for -d, multiple delimi… patch --dry-runpatch --dry-run reports whether a patch applies cleanly without modifying any files. Reference for the flag,… patchpatch applies a diff (patch file) to source files. Reference for -p1, --dry-run, -R reverse, and the malforme… pbzip2pbzip2 is a parallel bzip2 that uses multiple cores to write compatible .bz2 files faster. Reference for -p p… pdftoppmpdftoppm (poppler) renders PDF pages to PNG/JPEG/PPM images. Reference for -png, -r DPI, -f/-l page range, an… perf recordperf record samples a running program and writes perf.data for later analysis. Reference for -g call graphs,… perf reportperf report opens a perf.data file and shows where a program spent its time, by symbol and call path. Referen… perf statperf stat runs a command and reports hardware and software performance counters: cycles, instructions, cache… pg_basebackuppg_basebackup takes a physical base backup of a PostgreSQL cluster. Reference for -D, -Ft, -z, -X, and the re… pg_ctlpg_ctl starts, stops, and controls a local PostgreSQL server. Reference for init, start, stop, -D, -w, and th… pg_dumpReference for pg_dump: format flags (-F c/d/t/p), -f, -t, -n, --no-owner, and a CI example that exports a Pos… pg_dumppg_dump exports a PostgreSQL database to a script or archive. Reference for -Fc, -Fp, --schema-only, -t, and… pg_dumppg_dump exports a PostgreSQL database to a script or archive. Reference for -F, -f, -t, -n, --no-owner, and t… pg_isreadyReference for pg_isready: -h, -p, -t, -q, the 0/1/2/3 exit codes, and a CI wait loop that blocks until a Post… pg_isreadypg_isready checks whether a PostgreSQL server is accepting connections. Reference for -h, -p, -t, the exit co… pg_isreadypg_isready checks whether a PostgreSQL server is accepting connections, the standard readiness gate before mi… pg_restoreReference for pg_restore: -d, -C, -j, --clean, --no-owner, --exit-on-error, and a CI example that rebuilds a… pg_restorepg_restore loads a custom or directory pg_dump archive into PostgreSQL. Reference for -d, -j, --clean, --no-o… pg_restorepg_restore rebuilds a database from a pg_dump archive. Reference for -d, -C, -j, --clean, --no-owner, and the… pgbenchpgbench runs benchmark workloads against PostgreSQL. Reference for -i, -s, -c, -j, -T, -f, and the "relation… pgbouncer configPgBouncer has no config-test flag, so CI validates by starting it briefly or parsing pgbouncer.ini. Reference… pgclipgcli is an enhanced PostgreSQL client with autocomplete. Reference for the connection URL, -c, --csv, batch… pgloaderpgloader migrates data into PostgreSQL from MySQL, SQLite, CSV, and more. Reference for the command file, con… pigzpigz is a parallel gzip that uses all cores to produce standard .gz files faster. Reference for -p threads, -… pinactpinact rewrites uses: lines in GitHub Actions workflows to pin actions to full commit SHAs. Reference for pin… ping MTUping with -M do and -s finds the path MTU by forbidding fragmentation, exposing the black-hole stalls that br… pingReference for ping: -c, -W, -i, the ICMP-blocked caveat, and a CI example that checks basic host reachability… pingping sends ICMP echo requests to test reachability and measure latency. Reference for -c, -W, -i, and why pin… pingping tests reachability with ICMP echo. Reference for -c, -W, -i, -4/-6, and the "Operation not permitted" an… pipx installpipx install puts a Python CLI in an isolated venv on PATH. Reference for pipx ensurepath and the "not on PAT… pkill / pgreppgrep finds and pkill signals processes by name or pattern. Reference for -f, -u, exact matching, and cleanin… pngquantpngquant shrinks PNGs by converting to a palette (lossy) with controllable quality. Reference for --quality,… prpr paginates and columnates text for printable CI reports and side-by-side merges. Reference for -m, -t, -w,… pre-commit (CI config)pre-commit run wires actionlint, yamllint, and other CI-config linters into a single hook you can run in a PR… printfprintf formats output predictably in CI, unlike echo. Reference for format specifiers, %s, %b, and escapes, p… printfprintf formats strings and emits exact bytes without echo surprises. Reference for %s, %b, \x escapes, format… prisma migrate deployprisma migrate deploy applies pending migrations non-interactively, the correct command for CI. Reference for… prisma migrate statusprisma migrate status reports applied, pending, and failed migrations and exits non-zero when out of sync. Re… promtool checkpromtool check validates Prometheus configs and rules. Reference for check config, check rules, --syntax-only… promtool querypromtool query runs PromQL against a Prometheus server. Reference for instant, range, --time, -o, and the con… ps (tree)ps -ef --forest and pstree show parent/child process relationships. Reference for finding orphaned test proce… ps aux --sortps aux sorted by %mem or %cpu finds the heaviest process on a runner. Reference for the columns, RSS vs VSZ,… psReference for ps: aux, -ef, -o custom columns, --sort, and a CI example that lists running processes to debug… psps lists running processes. Reference for aux, -ef, -o, --sort, and finding the PID of a stuck background pro… psql -fpsql -f file.sql runs a SQL script for migrations and seeding. Reference for -f, ON_ERROR_STOP, --single-tran… psql \copyThe psql \copy meta-command streams CSV/TSV between a file and a table client-side. Reference for FROM, TO, C… psql authHow psql authenticates in CI: PGPASSWORD, a .pgpass file, and connection URIs. Reference for avoiding passwor… psqlReference for the psql PostgreSQL client: connection flags, -c and -f, PGPASSWORD, ON_ERROR_STOP, and a CI ex… psql \dtpsql backslash meta-commands like \dt, \d, \l, and \du inspect a PostgreSQL database. Reference for scripting… psqlpsql connects to PostgreSQL and runs SQL from the command line. Reference for -h, -U, -d, -c, PGPASSWORD, and… psqlpsql is the PostgreSQL interactive terminal and script runner. Reference for -h, -U, -d, -c, -f, PGPASSWORD,… pulsar-admin namespacespulsar-admin namespaces create and set-retention manage Pulsar namespaces. Reference for tenant/namespace syn… pulsar-admin topicspulsar-admin topics create, list, and stats manage Apache Pulsar topics. Reference for the fully-qualified to… pulsar-clientpulsar-client produce and consume send and read Pulsar messages from the shell. Reference for -m, -n, -s subs… pup (CI usage)pup filters HTML by CSS selector and emits text, attributes, or JSON. Reference for text{}, attr{}, json{} di… puppup parses HTML with CSS selectors and display functions like text{} and attr{}. Reference for selectors, jso… pwsh (PowerShell)pwsh runs PowerShell Core scripts in CI. Reference for -File, -Command, -NoProfile, $LASTEXITCODE, $ErrorActi… py-spy dumppy-spy dump prints the current call stack of every thread in a running Python process, ideal for diagnosing a… py-spy recordpy-spy record samples a running Python process and writes a flame graph or speedscope profile with no code ch… py-spy toppy-spy top shows a live, top-like view of which Python functions are consuming CPU right now. Reference for -… pyenv installpyenv install builds a Python version from source. Reference for build dependencies, and the "BUILD FAILED" m… pyenv localpyenv local pins a Python version via .python-version. Reference for the file, the shim PATH requirement, and… python jinja2Render a Jinja2 template from a short python -c one-liner when no jinja CLI is installed. Reference for Stric… q (text-as-sql)q runs SQL on plain text and CSV files, treating stdin or a file as a table. Reference for -H, -d, -O, and th… qpdf decryptqpdf --decrypt strips PDF encryption when you know the password. Reference for --password, --decrypt, exit co… qpdf linearizeqpdf --linearize produces web-optimized (fast web view) PDFs and can repair/merge them. Reference for --linea… qsvqsv is a fast CSV toolkit (a xsv fork) with select, search, stats, and join subcommands. Reference for the co… rabbitmqadmin declarerabbitmqadmin declare queue creates a RabbitMQ queue over the HTTP API. Reference for name, durable, --vhost,… rabbitmqadmin listrabbitmqadmin list queues/exchanges/bindings inspects RabbitMQ topology over HTTP. Reference for column selec… rabbitmqadmin publishrabbitmqadmin publish sends a message and get reads one back over the RabbitMQ HTTP API. Reference for routin… rabbitmqctl add_userrabbitmqctl add_user, set_permissions, and set_user_tags provision a RabbitMQ user for tests. Reference for t… rabbitmqctl list_queuesrabbitmqctl list_queues reports queue names, message counts, and consumers from inside the broker node. Refer… rabbitmqctl statusrabbitmqctl status and ping report whether a RabbitMQ node is up and healthy. Reference for status, ping, awa… ragerage is a Rust implementation of age with the same file format. Reference for rage encrypt/decrypt, rage-keyg… ratchetratchet pins GitHub Actions, container images, and other CI references to immutable digests and updates them.… rbenv installrbenv install builds a Ruby version via ruby-build. Reference for build deps, .ruby-version, and the "BUILD F… readlink -freadlink -f resolves a path to its canonical absolute form in CI. Reference for -f, -e, and -m, plus the macO… redis-benchmarkredis-benchmark stress-tests a Redis server. Reference for -n, -c, -t, -P, -q, and the auth and "flushes the… redis-cli --clusterredis-cli --cluster creates and checks a Redis Cluster from the command line. Reference for create, --cluster… redis-cli --scanredis-cli --scan iterates keys without blocking the server. Reference for --pattern, --count, piping to xargs… redis-cliReference for redis-cli: -h, -p, -a, -n, ping, the URI form, and a CI healthcheck loop that waits for a Redis… redis-cli CONFIGredis-cli CONFIG GET and CONFIG SET read and change Redis runtime parameters like maxmemory and appendonly. R… redis-cli INFOredis-cli INFO returns server, memory, replication, and persistence stats. Reference for INFO sections, scrip… redis-cli pingredis-cli PING checks whether a Redis server is responsive. Reference for the PONG reply, auth-before-ping, a… redis-cli streamsredis-cli XADD, XREAD, and XLEN drive Redis Streams from the shell for queue-style tests. Reference for the c… redis-cliredis-cli is the Redis command-line client. Reference for -h, -p, -a, -n, --user, and the NOAUTH, WRONGPASS,… regreg query/add/delete reads and writes Windows registry keys from scripts. Reference for /v, /d, /t, /f, /reg:… reindexdbreindexdb rebuilds indexes in a PostgreSQL database from the shell. Reference for -a, -s, -t, -i, --concurren… remarshalremarshal converts between JSON, YAML, TOML, and MessagePack, with json2yaml/yaml2json shortcuts. Reference f… render before applyRendering templated manifests to an artifact and diffing before kubectl apply catches config bugs in CI. Refe… reproducible tarDeterministic tarballs need fixed order, mtime, and ownership so the bytes match across builds. Reference for… resolvectlresolvectl queries and inspects systemd-resolved DNS. Reference for query, status, flush-caches, and the stub… revrev reverses the characters of every line, useful for cutting from the end of a string. Reference for the tri… rg --type / --globripgrep --type and --glob restrict which files rg searches. Reference for -t, -T, --glob, --type-list, and th… rg -l / CI gatesripgrep -l lists files that contain a match, and rg exit codes let you gate CI on presence or absence of a pa… ripgrep (rg)ripgrep (rg) recursively searches for a regex, respecting .gitignore by default. Reference for the core searc… rm -rfrm -rf removes files and directories in CI cleanup. Reference for -r, -f, and safe-deletion habits, plus the… robocopyrobocopy mirrors and copies directory trees on Windows. Reference for /MIR, /E, /NP, /R /W, and the critical… rocm-smirocm-smi is the AMD ROCm equivalent of nvidia-smi. Reference for listing GPUs, showing utilization, and the R… routeroute shows and edits the routing table (legacy net-tools). Reference for -n, add default gw, and the "comman… rpm -irpm -i installs a local .rpm directly. Reference for -i, -U, --nodeps, query flags, and the "Failed dependenc… rpmReference for rpm: -i, -U, -e, -q, -ql, -qf, and a CI example that installs a local .rpm and queries which pa… rq (record query)rq (record-query) converts between JSON, YAML, TOML, CBOR, and MessagePack and filters records. Reference for… rsvg-convertrsvg-convert rasterizes SVG to PNG (or PDF) using librsvg. Reference for -w/-h, -d/-p DPI, -f format, and the… rsync --bwlimitrsync --bwlimit caps transfer speed so a deploy does not saturate a shared link. Reference for the rate synta… rsync --checksum (-c)rsync decides what to transfer using size plus mtime by default, or a full checksum with -c. Reference for re… rsync --chmodrsync --chmod sets permissions on transferred files regardless of the source modes. Reference for making depl… rsync --chownrsync --chown sets owner and group on transferred files. Reference for deploying as one user but landing file… rsync --deletersync --delete removes destination files that no longer exist in the source, turning a copy into a mirror. Re… rsync --dry-run (-n)rsync -n / --dry-run shows what would transfer and delete without touching anything. The safety check every -… rsync --exclude / --includersync --exclude and --include control which files transfer. Reference for pattern order, anchoring, and exclu… rsync --filterrsync --filter expresses include/exclude/protect rules and per-directory .rsync-filter files. Reference for m… rsync --mkpathrsync --mkpath creates missing leading directories on the destination. Reference for deploying into a path th… rsync --progress / --inforsync --progress shows per-file and overall transfer progress; --info=progress2 gives a single overall bar. R… rsync --rsync-pathrsync --rsync-path sets the remote rsync command, commonly "sudo rsync", so a deploy user can write to root-o… rsync --archive (-a)rsync -a is the archive flag that preserves permissions, timestamps, symlinks, and ownership while recursing.… rsync --itemize-changes (-i)rsync -i prints a compact per-file change code (the YXcstpoguax string). Reference for decoding what a deploy… rsync -P (--partial --progress)rsync -P combines --partial and --progress so interrupted transfers can resume. Reference for resuming large… rsync --verbose (-v)rsync -v prints each file as it transfers. Reference for verbosity levels, --stats, and keeping CI logs reada… rsync --compress (-z)rsync -z compresses file data in transit. Reference for when compression helps over SSH, --compress-level, an… rsync protocol version mismatchrsync "protocol version mismatch -- is your shell clean?" means the remote shell prints output before rsync s… rsyncrsync synchronizes files efficiently in CI deploys and cache restores. Reference for -a, -z, --delete, and th… rsync exit code 12rsync exit code 12 is a protocol data-stream error, usually a broken SSH connection or unclean remote shell.… rsync exit code 23rsync exit code 23 means a partial transfer due to errors: some files or attributes were not transferred. Ref… rsync exit codes 5 and 30rsync exit code 5 is a client/server startup or daemon error; code 30 is a data send/receive timeout. Referen… rsync -e sshrsync over SSH deploys artifacts to a remote server securely. Reference for -e ssh, custom ports, key auth, a… rsync trailing slash on sourceA trailing slash on the rsync source means "the contents of this directory" instead of "the directory itself"… Deploying artifacts with rsyncHow to deploy CI build artifacts to a server with rsync: archive mode, mirroring with --delete, protecting ru… Syncing a cache dir with rsyncUse rsync to copy a cache directory between CI steps or a cache host: incremental sync, --checksum vs mtime,… rsyncrsync synchronizes files efficiently, locally or over SSH. Reference for -a, --delete, -z, trailing slashes,… scsc creates, starts, queries, and deletes Windows services from scripts. Reference for create, start, query, d… scoop installscoop install adds command-line tools to a per-user path without admin. Reference for buckets, scoop install,… scp -P portscp -P sets the remote port, which is uppercase unlike ssh -p. Reference for the port flag and the connection… scp -r recursivescp -r copies whole directory trees over SSH. Reference for recursive copies, trailing-slash behavior, and th… scpscp copies files between hosts over SSH in CI deploys. Reference for -r, -i, and -P, plus the uppercase-port… scp copy filesscp copies files between the runner and a remote host over SSH. Reference for source/destination syntax and t… scpscp copies files between hosts over SSH. Reference for -r, -i, -P, and the host-key, permission, and "not a r… sd (find/replace)sd is an intuitive find-and-replace CLI that uses normal regex and string literals instead of sed dialects. R… sdiffsdiff shows two files side by side and can interactively merge them. Reference for -w, -s, -o for merge outpu… sdk install (SDKMAN!)sdk install manages JVM tools (Java, Gradle, Maven) via SDKMAN!. Reference for non-interactive mode and the "… sed multiple -esed runs several commands in one pass with multiple -e flags or semicolons. Reference for chaining substituti… sed -E extended regexsed -E switches to extended regular expressions so +, ?, |, and () work without backslashes. Reference for -E… sed -i in placesed -i edits a file in place instead of printing to stdout. Reference for the GNU vs BSD backup-suffix differ… sed -n p (print)sed -n with the p command prints only the lines you select, like a grep with addressing. Reference for -n, p,… sed -z nullGNU sed -z treats NUL as the line separator so the whole file is one record, enabling cross-line edits. Refer… sed a/i/cThe sed a, i, and c commands add or replace whole lines around an address. Reference for append, insert, and… sed bulk file editRun sed -i over many files at once using find or a glob. Reference for safe bulk in-place edits, parallelism,… sed ! negationThe sed ! operator inverts an address so a command runs on every line except the matched ones. Reference for… sed rangessed ranges apply a command across a span of lines using M,N numbers or /start/,/end/ regexes. Reference for r… sed anchors classessed patterns use ^, $, and POSIX character classes to match precisely. Reference for anchoring config edits a… sed c (change)The sed c command replaces an entire addressed line or range with new text. Reference for swapping config lin… sed backreferencessed capture groups let the replacement reuse matched text with \1..\9 and & for the whole match. Reference fo… sedsed is a stream editor for find-and-replace in CI builds. Reference for -i, -e, -E, and s///, plus the GNU-vs… sed d (delete)The sed d command deletes matching lines from the output. Reference for deleting by line number, range, and r… sed delimiterssed lets you pick any delimiter for the s command, so paths full of slashes need no escaping. Reference for c… sed GNU vs BSDGNU sed on Linux and BSD sed on macOS differ on -i, -E, a/i/c, and word boundaries. Reference for writing sed… sed hold spacesed has a second buffer, the hold space, manipulated with h, H, g, G, and x for multi-line tricks. Reference… sed stdin pipesed reads from stdin when given no file, making it ideal for pipelines. Reference for piping into sed, the -… sed line addressingsed addresses select which lines a command runs on: a line number, $ for last, or a /regex/. Reference for si… sed quoting in yamlEmbedding sed in a GitHub Actions run step mixes shell, YAML, and sed quoting. Reference for the quoting and… sed s/// flagssed substitution flags g, i, p, and N control which matches change. Reference for global, case-insensitive, p… sed s/// substituteThe sed s/// command replaces matched text on each line. Reference for the pattern, replacement, and the basi… sed version bumpUse sed to update version strings in package.json, pom.xml, and config files during release. Reference for sa… sed edit inised updates key=value lines in INI and properties files by anchoring the key. Reference for section-scoped ed… sed edit yamlEditing YAML with sed works for simple key updates but ignores structure. Reference for anchoring keys, prese… sed w and =The sed w command writes matched lines to a file and = prints line numbers. Reference for splitting output an… sed y/// translateThe sed y/// command maps each character in one set to the matching character in another, like tr. Reference… sedsed is a stream editor for filtering and transforming text. Reference for -i, -e, -E, s///, and the GNU-vs-BS… Select-StringSelect-String (alias sls) searches files and pipeline text with regex, the PowerShell grep. Reference for -Pa… seqseq prints a sequence of numbers for loops, retries, and zero-padded IDs. Reference for -w, -f, -s, step valu… serviceReference for the service command: start, stop, status, --status-all, the SysV/init wrapper role, and a CI ex… set -e (errexit)set -e makes a shell exit on the first failing command. Reference for its scope, the && and pipeline exceptio… set -euo pipefailset -euo pipefail makes bash CI scripts fail fast. Reference for -e exit-on-error, -u unset-var, and pipefail… set -o pipefailset -o pipefail makes a pipeline fail if any stage fails, not just the last. Reference for its tee/head inter… Set-ExecutionPolicySet-ExecutionPolicy controls whether PowerShell runs .ps1 scripts. Reference for Bypass, -Scope Process, Remo… setx / $envsetx persists environment variables and $env:/set define them for the session. Reference for setx /M, the 102… sha1sumsha1sum computes and verifies SHA-1 checksums, still seen with git objects and legacy manifests. Reference fo… sha256sumsha256sum computes and verifies checksums in CI for download integrity. Reference for -c verify mode, --statu… sha256sumsha256sum computes and verifies SHA-256 checksums. Reference for -c, --check, the two-space format, and the "… sha256sumsha256sum computes and verifies SHA-256 checksums, the standard for verifying downloads in CI. Reference for… sha512sumsha512sum computes and verifies SHA-512 checksums, common for large release artifacts. Reference for -c, --ch… shufshuf shuffles lines or draws a random sample with -n. Reference for -n, -e, -i, --random-source for reproduci… siegesiege is an HTTP load tester and benchmark. Reference for -c, -r, -t, -b, -f urls.txt, and the file-descripto… signifysignify is OpenBSD's Ed25519 signing tool. Reference for -G generate, -S sign, -V verify, -e embedded, and th… gpg git tagsgit tag -s signs an annotated tag with GPG and git tag -v verifies it. Reference for release tag signing, tag… gpg git commitsConfigure git to sign commits with a GPG key using user.signingkey and commit.gpgsign. Reference for the git… signtool signsigntool sign applies an Authenticode signature with a timestamp. Reference for /fd, /tr, /td, /a, /n, and th… sleepsleep pauses execution for a set duration. Reference for suffixes, fractional seconds, retry-loop use, and th… snap installsnap install adds snap packages on Ubuntu. Reference for --classic, channels, and the "cannot communicate wit… socat forwardsocat relays bytes between two endpoints to forward ports or bridge a service into a test. Reference for TCP-… socatsocat is a multipurpose bidirectional relay between two data channels. Reference for TCP/UNIX/STDIO addresses… sops -e / -dsops -e encrypts and -d decrypts structured secrets files in place-aware form. Reference for -e, -d, -i, --ou… sops exec-envsops exec-env decrypts a file and runs a command with the secrets in the environment. Reference for exec-env,… sops updatekeyssops updatekeys re-encrypts files to the current .sops.yaml recipients without changing values. Reference for… sops age / kmssops resolves keys from age recipients or cloud KMS. Reference for --age, --kms, SOPS_AGE_KEY, .sops.yaml cre… sort -hsort -h orders human-readable sizes like 1K, 2M, 3G correctly. Reference for -h, pairing with du -h, and the… sort -ksort -k sorts by a chosen field rather than the whole line. Reference for -k, -t field separators, key ranges… sort -nsort -n orders lines by numeric value instead of as strings. Reference for -n, -g, and the locale and leading… sort -rsort -r reverses the sort order, ideal for top-N selection with head. Reference for -r, combining with -n, an… sort -tsort -t sets the character that separates fields for -k. Reference for -t, CSV and colon-delimited data, and… sort -usort -u sorts lines and removes duplicates in one pass. Reference for -u, how it differs from uniq, and the k… sort -Vsort -V orders version strings like 1.2.10 after 1.2.9. Reference for -V, tag and release sorting, and the BS… sortsort orders lines of text in CI for stable diffs. Reference for -n, -u, -k, -t, and -r, plus the locale gotch… sortsort orders lines of text. Reference for -n, -u, -k, -t, -r, and the locale-dependent ordering and "sort -u v… sourcesource runs a script in the current shell so its variables persist. Reference for source vs ., bashism portab… split -bsplit -b breaks a file into fixed-size byte chunks, ideal for upload limits. Reference for -b, size suffixes,… split -lsplit -l breaks a large file into chunks of N lines each. Reference for -l, suffix control, -d numeric suffix… spongesponge (moreutils) soaks up all stdin before writing, so you can filter a file in place without truncating it… sq (Sequoia)sq is the Sequoia PGP CLI for OpenPGP encryption and signing. Reference for sq encrypt, sq sign, sq verify, k… sqitch deploysqitch deploy applies pending changes to a target database. Reference for the target URI, deploy --verify, an… sqitch revertsqitch revert undoes deployed changes back to a target change using revert scripts. Reference for --to-change… sqitch verifysqitch verify runs each verify script against a target to confirm deployed changes are present. Reference for… sqlcmdsqlcmd connects to Microsoft SQL Server and runs SQL from the shell. Reference for -S, -U, -P, -Q, -i, -b, an… sqlite3 .dumpsqlite3 .dump exports a SQLite database as SQL and restores it by replaying that SQL. Reference for .dump, .s… sqlite3 .dumpThe sqlite3 .dump meta-command exports a SQLite database to SQL. Reference for .dump, redirecting to a file,… sqlite3 .importsqlite3 .import loads a CSV or TSV file into a SQLite table for test fixtures. Reference for .mode csv, --ski… sqlite3Reference for the sqlite3 CLI: running SQL inline, .dump, .read, .mode, -csv, and a CI example that builds an… sqlite3sqlite3 runs SQL and dot-commands against a SQLite database file. Reference for .tables, .schema, inline SQL,… sqlite3sqlite3 is the SQLite command-line shell. Reference for .read, .mode, -cmd, -batch, and the "database is lock… sqlplussqlplus is the Oracle Database command-line client. Reference for the connect string, @script, -S, and the OR… ss -ltnpss -ltnp lists listening TCP sockets with the owning process. Reference for the flags, reading the output, an… ssReference for ss: -tlnp, -s, state filters, the netstat replacement role, and a CI example that confirms a se… ssss is the modern socket inspector that replaces netstat. Reference for -t, -l, -n, -p, sport filters, and the… ssh -A forwardingssh -A forwards your local ssh-agent to the remote host so it can authenticate onward. Reference for the flag… ssh -i identityssh -i selects the private key to authenticate with, instead of the default ~/.ssh/id_*. Reference for identi… ssh -J jump hostssh -J (ProxyJump) connects through one or more bastion hosts to reach a target on a private network. Referen… ssh -L tunnelssh -L forwards a local port through an SSH connection to reach a service behind a bastion. Reference for -L,… ssh BatchModessh -o BatchMode=yes disables all interactive prompts so ssh fails instead of hanging in CI. Reference for ba… StrictHostKeyCheckingssh -o StrictHostKeyChecking controls how ssh handles unknown host keys. Reference for accept-new, no, and th… UserKnownHostsFilessh -o UserKnownHostsFile selects which known_hosts file ssh reads and writes. Reference for using a custom f… ssh -p portssh -p sets the TCP port to connect to when the server does not listen on 22. Reference for the port flag and… ssh -t / -Tssh -t forces a pseudo-terminal and -T disables it. Reference for when each matters in CI and the "Pseudo-ter… ssh -vssh -v prints the connection and authentication steps so you can see exactly where an SSH connection fails in… sshssh opens a secure remote shell or runs a remote command in CI deploys. Reference for -i, -o, BatchMode, and… ssh key permissionsOpenSSH rejects keys and config files that are too permissive. Reference for the 600/700 rules and the "Permi… ssh remote commandPassing a command to ssh runs it on the remote host and returns its exit code. Reference for non-interactive… ssh-addssh-add loads private keys into a running ssh-agent, optionally from stdin. Reference for -l, -D, lifetime, a… ssh-agent in CIssh-agent holds decrypted keys in memory so commands need no key file or passphrase. Reference for starting t… ssh-agentssh-agent holds decrypted SSH keys for non-interactive use. Reference for eval, ssh-add, SSH_AUTH_SOCK, and t… ssh-copy-idssh-copy-id installs your public key into a remote authorized_keys. Reference for -i, -p, -f, and the passwor… ssh-keygen -lssh-keygen -l prints the fingerprint of a public or private key for verification. Reference for -l, -E hash c… ssh-keygen -Nssh-keygen -N "" creates a key with no passphrase so CI can use it unattended. Reference for setting, changin… ssh-keygen -Rssh-keygen -R removes a host from known_hosts after its key changes. Reference for -R, hashing with -H, and t… ssh-keygen -yssh-keygen -y derives the public key from a private key, useful when only the private half is stored as a sec… ssh-keygen generatessh-keygen creates a new SSH key pair. Reference for -t ed25519/rsa, -b key size, -C comment, -f output file,… ssh-keygenssh-keygen creates and manages SSH keys and known_hosts. Reference for -t, -f, -N, -R, -l, and the passphrase… ssh-keyscanssh-keyscan fetches a host\u2019s public keys to pre-seed known_hosts in CI. Reference for -H, -t, -p, and th… ssh-keyscanssh-keyscan fetches a server's public host keys to populate known_hosts non-interactively. Reference for -t,… ssh-keyscanssh-keyscan fetches a host's public SSH keys to pre-seed known_hosts. Reference for -H, -t, -p, and the host-… sshssh opens a secure remote shell or runs a remote command. Reference for -i, -o, known_hosts, and the "Host ke… step ca certificatestep ca certificate requests a signed certificate from a step-ca server. Reference for --token, --provisioner… step certificate createstep certificate create issues certificates and keys, including self-signed and CA-signed. Reference for --pr… step crypto jwtstep crypto jwt sign and verify create and validate JSON Web Tokens. Reference for --key, --iss, --aud, --alg… strace -cstrace traces system calls; -c counts and times them, -f follows child processes. Reference for -c, -f, -e, a… strace -pstrace -p <pid> attaches to an already-running process to see what it is doing right now. Reference for diagn… stracestrace runs a command and prints every system call it makes. Reference for -f, -e trace, -o, and using it to… stress-ngstress-ng loads CPU, memory, and I/O to stress a system. Reference for --cpu, --vm, --timeout, --metrics, and… stringsstrings prints runs of printable characters from a binary, useful for finding versions, paths, or leaked secr… supabase dbsupabase db manages local and remote Postgres schema for Supabase projects. Reference for push, reset, diff,… sysbenchsysbench benchmarks CPU, memory, and databases. Reference for cpu/memory/fileio tests, --threads, prepare/run… systemctl --failedsystemctl --failed lists every systemd unit that failed to start. Reference for triaging a runner that boots… systemctlReference for systemctl: start, status, is-active, enable, the no-systemd-in-containers caveat, and a CI exam… systemctl statussystemctl status shows whether a systemd service is active, its main PID, and the last log lines. Reference f… tactac prints lines in reverse order, the opposite of cat. Reference for -s separators, the BSD/macOS absence go… tail -f / -Ftail -f streams new lines as a file grows; -F also handles rotation. Reference for -f, -F, --pid, and the han… tail -ntail -n prints the last N lines, or from line N onward with +N. Reference for -n, the +N skip-header idiom, a… tailtail prints the last lines of input or follows a growing file in CI. Reference for -n, -f, and +N, plus the -… tailtail prints the last lines of input or follows a growing file. Reference for -n, -f, +N, and the "-f never ex… tar exclude (--exclude)tar --exclude omits files matching a pattern from the archive. Reference for --exclude and --exclude-vcs plus… tar no-same-ownertar --no-same-owner makes extracted files owned by the current user instead of the stored uid. Reference for… tar strip (--strip-components)tar --strip-components removes leading path parts on extract. Reference for the flag plus the empty-extract a… tar zstd (--zstd)tar --zstd filters the archive through zstd for fast, high-ratio .tar.zst files. Reference for --zstd plus th… tar change dir (-C)tar -C changes directory before adding or extracting paths. Reference for -C plus the wrong-prefix and path-n… tar create (-c)tar -c bundles files and directories into a single archive. Reference for the -c, -f, and -v flags plus the p… tar file (-f)tar -f tells tar which archive file to read or write, or to use stdin/stdout. Reference for the -f flag and t… tar bzip2 (-j)tar -j filters the archive through bzip2 for .tar.bz2 files. Reference for the -j flag plus the missing-bzip2… tar xz (-J)tar -J filters the archive through xz for .tar.xz files. Reference for the uppercase -J flag plus the case-co… tar preserve perms (-p)tar -p preserves stored file permissions on extract. Reference for -p and the umask interaction plus the perm… tar append/update (-r/-u)tar -r appends files to an archive and -u updates changed ones. Reference for append/update plus the cannot-u… tar list (-t)tar -t prints the table of contents of an archive without extracting. Reference for -t and -v plus the format… tar verbose (-v)tar -v lists each file as it is archived or extracted. Reference for -v and -vv plus the log-noise and exit-s… tar extract (-x)tar -x unpacks an archive into the current directory. Reference for -x, -C, and auto-decompression plus the s… tar gzip (-z)tar -z filters the archive through gzip for .tar.gz files. Reference for the -z flag plus the not-in-gzip-for… tartar bundles and extracts archives in CI for caches and artifacts. Reference for -c, -x, -z, -C, and the compr… tar over sshPiping tar through ssh copies a directory tree without a temp file. Reference for the create-pipe-extract pat… tar vs zipWhen to prefer tar over zip in pipelines: permissions, symlinks, streaming, and cross-platform delivery. Refe… tar + docker save/loaddocker save streams an image as a tar that you can compress and reload. Reference for save/load plus the not-… tar stdin/stdouttar -f - reads or writes the archive on a pipe for streaming workflows. Reference for piping tar plus the bro… tar disk-full errorstar write errors mean the destination disk filled up mid-archive. Reference for the no-space and short-write… tar exit-failure statusThis tar message is a summary line, not the real cause. Reference for reading the error above it plus the com… tar leading slashtar strips the leading slash from absolute paths by default for safety. Reference for the warning and -P plus… tartar bundles files into archives and extracts them. Reference for -c, -x, -z, -C, and the "Cannot open: No suc… taskkilltaskkill ends processes by name or PID on Windows. Reference for /IM, /PID, /F, /T, and the "process not foun… tcpdump filterstcpdump BPF filter expressions narrow a capture to a host, port, or TCP flag. Reference for host, port, src/d… tcpdump capturetcpdump captures packets on an interface to see what a failing connection actually does. Reference for -i, -n… tcpdumptcpdump captures and inspects network packets. Reference for -i, -n, -w, -c, BPF filters, and the permission… tee -atee writes stdin to files and stdout at once; -a appends instead of truncating. Reference for -a, multiple fi… teetee writes stdin to a file and stdout at once in CI logging. Reference for -a append, multiple files, and the… teetee writes stdin to stdout and to files at once. Reference for -a, sudo tee, pipefail interaction, and the pe… teller envteller env prints the resolved secrets as export statements you can eval into a shell. Reference for the shel… teller runteller run loads secrets from providers defined in .teller.yml and runs a command with them in the environmen… telnettelnet host port opens a raw TCP connection to confirm a port is reachable and to speak a text protocol. Refe… telnettelnet opens a raw TCP connection, often used as a port check. Reference for the connect test, the "Connectio… Test-PathTest-Path returns true/false for whether a path exists in PowerShell. Reference for -PathType, -Path vs -Lite… tfenvtfenv installs and switches Terraform versions, reading .terraform-version. Reference for install, use, min-r… timeouttimeout caps how long a command may run in CI, preventing hangs. Reference for duration units, -k kill-after,… timeouttimeout runs a command and kills it if it exceeds a duration. Reference for the duration syntax, -s, -k, and… timeouttimeout runs a command with a time limit and kills it if it overruns. Reference for -s, -k, duration suffixes… tmplThe tmpl CLI renders Go text/template files against YAML/JSON/env data. Reference for value files, env access… tofuenvtofuenv installs and switches OpenTofu versions, the tfenv fork for OpenTofu. Reference for install, use, .op… tokei (LOC count)tokei counts lines of code, comments, and blanks per language, fast. Reference for the output, --output json,… tomlqtomlq (from the yq/xmlutils package) reads TOML, converts to JSON, and applies a jq filter. Reference for -t… top / htoptop shows live CPU, memory, and load. Reference for batch mode in CI, reading the load average and %wa, and s… topReference for top: -b batch mode, -n, -o, -d, the non-interactive logging pattern, and a CI example that capt… torch.cuda checkpython -c "import torch; torch.cuda.is_available()" checks whether PyTorch can use the GPU. Reference for the… tqtq is a small Rust CLI that queries TOML with a dotted-path selector, no jq required. Reference for -f, -o ou… tr -dtr -d deletes every character in the given set from the stream. Reference for -d, stripping newlines and carr… tr -str -s collapses runs of a character into one, often used to normalize whitespace. Reference for -s, prepping… trtr translates, squeezes, or deletes characters from stdin in CI. Reference for -d, -s, -c, and ranges, plus t… tr translatetr maps one set of characters to another, character by character. Reference for SET1/SET2, [:upper:]/[:lower:… trtr translates, squeezes, or deletes characters from stdin. Reference for -d, -s, -c, ranges, and the "tr read… tracerouteReference for traceroute: -n, -m, -w, -T, the hop-by-hop diagnosis use, and a CI example that traces the path… traceroutetraceroute maps the hops between the runner and a host to find where packets stall or stop. Reference for -n,… traceroutetraceroute maps the network path to a host hop by hop. Reference for -n, -m, -w, -T, and the "* * *" timeouts… traefik healthchecktraefik healthcheck calls the ping endpoint and exits by status, ideal as a Docker HEALTHCHECK. Reference for… traptrap runs cleanup handlers on signals and exit in CI scripts. Reference for EXIT, ERR, and signal traps so te… traptrap runs a handler on signals or shell EXIT. Reference for EXIT, ERR, cleanup patterns, and the quoting and… trtexectrtexec builds a TensorRT engine from an ONNX model and benchmarks it. Reference for --onnx, --fp16, --saveEn… truncatetruncate shrinks, grows, or empties a file to an exact size for fixtures and quota tests. Reference for -s, +… ulimit -nulimit -n shows and sets the per-process open file descriptor limit. Reference for soft vs hard limits and fi… ulimitReference for ulimit: -n, -u, -a, soft vs hard limits, the too-many-open-files fix, and a CI example that rai… uname -auname reports the kernel name, version, and machine architecture. Reference for -m, -r, and detecting arm64 v… unameReference for uname: -a, -s, -m, -r, the OS/arch detection use, and a CI example that branches a script on op… unexpandunexpand converts runs of spaces into tabs, the inverse of expand. Reference for -a, -t, --first-only, and CI… uniq -cuniq -c prefixes each line with how many times it repeated. Reference for -c, the must-be-sorted rule, and th… uniq -d / -uuniq -d prints only repeated lines and -u only non-repeated lines. Reference for -d, -u, -D, and the sorted-i… uniquniq filters or counts adjacent duplicate lines in CI. Reference for -c, -d, -u, and -i, plus the must-sort-f… uniq sorted inputuniq only deduplicates adjacent lines, so input must be sorted first. Reference for the adjacency rule, sort… uniquniq filters or counts adjacent duplicate lines. Reference for -c, -d, -u, -i, and the "must sort first" mist… unrarunrar extracts .rar archives that other tools cannot write. Reference for x with paths, e flat, l list, -p pa… unxzunxz decompresses .xz files, the inverse of xz. Reference for -k keep, -c stdout, -t test, -T0, and the File-… unzip -dunzip -d extracts an archive into a chosen directory instead of the current one. Reference for -d, directory… unzip -j -xunzip -j flattens paths on extraction, -x excludes patterns, and naming files extracts only those. Reference… unzip -l -v -qunzip -l lists archive contents, -v adds compression and CRC detail, and -q quiets extraction logs. Reference… unzip -Ounzip -O sets the charset for decoding filenames in archives made on other systems. Reference for -O, -I, and… unzip -ounzip -o overwrites existing files without asking, and -n never overwrites. Reference for the overwrite promp… unzip -punzip -p writes a single archived file to standard output for piping. Reference for -p, -c, and reading one f… unzip -tunzip -t verifies an archive integrity without extracting by checking every CRC. Reference for -t and the tru… unzipunzip extracts .zip archives in CI. Reference for -o, -d, -q, and -l, plus the interactive overwrite prompt t… unzipunzip extracts .zip archives. Reference for -o, -d, -q, -l, and the "End-of-central-directory not found" and… unzstdunzstd decompresses .zst files, the inverse of zstd. Reference for -c stdout, -k keep, --long window, -o outp… update-alternativesupdate-alternatives manages symlinks for interchangeable commands like python and gcc. Reference for --instal… update-ca-certificatesupdate-ca-certificates rebuilds the system trust store after adding a CA. Reference for the Debian and Alpine… update-ca-certificatesupdate-ca-certificates rebuilds the system trust store from custom CA certs. Reference for the install flow a… uptimeuptime shows how long the host has run and the 1/5/15-minute load averages. Reference for interpreting load r… usqlusql is a universal SQL client with a psql-like interface for Postgres, MySQL, SQL Server, SQLite, and more.… vacuumdbvacuumdb cleans and analyzes a PostgreSQL database from the shell. Reference for -z, -a, -f, -j, --analyze-on… valgrind --leak-checkvalgrind with Memcheck detects memory leaks and invalid access in native programs. Reference for --leak-check… valgrind callgrindvalgrind --tool=callgrind records call counts and instruction costs per function. Reference for callgrind_ann… valgrind massifvalgrind --tool=massif profiles heap usage over time and writes massif.out for ms_print or massif-visualizer.… varnishd -Cvarnishd -C compiles a VCL file and prints the generated C without starting the cache. Reference for -C, -f,… varnishtestvarnishtest runs VTC test cases that exercise Varnish and its VCL end to end. Reference for -v, -k, the vtc f… vault kv getvault kv get reads a secret from a KV v2 engine. Reference for -field, -format, -mount, -version, and the pat… vault kv put / writevault kv put writes KV secrets and vault write posts to any path. Reference for key=value pairs, @file input,… vault loginvault login authenticates the CLI to a Vault server. Reference for -method, VAULT_ADDR, token and jwt/oidc au… vegeta attackvegeta attack drives constant-rate HTTP load. Reference for -rate, -duration, -targets, report/plot, and the… vimdiffvimdiff opens two to four files in Vim side by side with folded, highlighted differences for interactive revi… visidata (vd)VisiData (vd) is a terminal explorer for tabular data across CSV, JSON, Parquet, and SQLite, with a batch mod… vmstatvmstat samples CPU, memory, swap, and I/O over time. Reference for reading the si/so swap and wa columns to t… volta installvolta install adds Node tools that Volta pins and auto-switches. Reference for pin vs install, the PATH/shim… vswherevswhere finds the Visual Studio / Build Tools install path so scripts can locate msbuild and VC tools. Refere… nc wait loopA nc -z retry loop blocks a CI job until a database or API port opens. Reference for the wait-for-it pattern,… clickhouse wait-for-readyPoll ClickHouse until it answers before running tests. Reference for the /ping HTTP check, a clickhouse-clien… mongosh wait-for-readyPoll MongoDB until it accepts connections before running tests. Reference for a mongosh ping health-check loo… wait-for-itwait-for-it.sh and dockerize -wait block until a TCP host:port is reachable before running a command. Referen… wait-for-it.shwait-for-it.sh blocks until a TCP host:port is reachable, then runs a command. Reference for -t, -s, -- cmd,… wait-onwait-on blocks until an HTTP, TCP, or file resource is available, fixing the race between starting a server a… wait-onwait-on blocks until an HTTP endpoint, port, or file is ready, so tests do not start against a service that i… waitwait blocks until background jobs finish and reports their exit status. Reference for wait $PID, wait -n, and… watchwatch re-runs a command at an interval and highlights changes. Reference for -n, -d, capturing a peak with ps… watchexecwatchexec watches files and runs a command when they change, with debouncing and gitignore support. Reference… watchexecwatchexec runs a command when files change. Reference for -e, -w, -r, --exts, and the "never exits in CI" han… wc -cwc -c counts bytes, effectively the file size. Reference for -c, the difference from -m, and the multibyte an… wc -lwc -l counts lines, the standard way to count matches or files. Reference for -l, the newline-counting truth,… wc -wwc -w counts whitespace-separated words. Reference for -w, what counts as a word, and the empty-input gotcha… wcwc counts lines, words, and bytes in CI. Reference for -l, -w, -c, and -m, plus the leading-whitespace gotcha… wdiffwdiff compares two files word by word instead of line by line, ideal for prose and long lines. Reference for… websocatwebsocat opens a WebSocket connection from the shell for testing realtime endpoints. Reference for ws:// and… websocatwebsocat is netcat for WebSockets. Reference for -1, -n, --text, -E, and the handshake (HTTP 101) and "connec… wget --content-dispositionwget --content-disposition saves files under the name the server suggests in the Content-Disposition header.… wget --headerwget --header adds custom HTTP headers such as Authorization or Accept. Reference for sending tokens, repeati… wget --mirrorwget --mirror downloads a full tree with timestamping and infinite depth. Reference for the mirror shortcut,… wget --no-check-certificatewget --no-check-certificate skips TLS verification. Reference for why to avoid it, the --ca-certificate alter… wget --post-datawget --post-data and --post-file send POST requests. Reference for posting form bodies, posting a file, setti… wget --spiderwget --spider checks that a URL exists without downloading it, useful for link checks and health gates. Refer… wget --timeoutwget --timeout, --connect-timeout, and --read-timeout bound how long a download waits. Reference for the time… wget --trieswget --tries, --retry-connrefused, and --waitretry retry transient download failures in CI. Reference for ret… wget --userwget --user, --password, and --auth-no-challenge handle HTTP Basic auth. Reference for credentials, sending a… wget -cwget -c resumes a partial download instead of starting over. Reference for the continue flag, when servers su… wget -e robots=offwget -e robots=off makes recursive downloads ignore robots.txt. Reference for the flag, when it is appropriat… wget -iwget -i reads URLs from a file (or stdin) and downloads each one. Reference for batch downloads, combining wi… wget -Nwget -N (--timestamping) skips files that have not changed since the last download. Reference for timestampin… wget pipe to shellwget -O - URL | sh runs a remote install script. Reference for the pattern, the serious security caution, and… wget -Owget -O writes a download to a filename you choose instead of guessing from the URL. Reference for -O, the -O… wget -Pwget -P (--directory-prefix) saves downloads into a chosen directory. Reference for the directory prefix flag… wget -q / -nvwget -q silences output and -nv (no-verbose) keeps just errors and the final line. Reference for quiet downlo… wget -rwget -r downloads recursively and -np (no-parent) keeps it within a path. Reference for depth, no-parent, acc… wgetwget is a non-interactive downloader for CI. Reference for -O, -q, --tries, and --timeout, and why it fails o… wget exit codeswget exit codes tell a pipeline why a download failed: network, auth, or server error. Reference for the exit… wget vs curlwget and curl both download in CI but differ in defaults, recursion, and output. Reference for when to pick e… wget DNS errorswget "unable to resolve host address" is a DNS failure, not a wget bug. Reference for the causes, --dns-timeo… wgetwget is a non-interactive network downloader. Reference for -O, -q, --tries, --timeout, and the 404 (exit 8)… where.exewhere.exe locates programs on PATH, the Windows equivalent of which. Reference for /R recursive search, /Q qu… whichReference for which: locating an executable in PATH, the command -v alternative, and a CI example that assert… winget installwinget install adds packages via the Windows Package Manager. Reference for --silent, --accept-package-agreem… woodpecker-cli execwoodpecker-cli exec runs a Woodpecker pipeline locally in Docker for testing. Reference for the exec flags, b… woodpecker-cli lintwoodpecker-cli lint checks a Woodpecker CI pipeline file for schema and best-practice issues. Reference for t… wrkwrk is a high-throughput HTTP benchmarking tool. Reference for -t, -c, -d, -s Lua scripts, and the "too many… wscat -cwscat -c connects to a WebSocket endpoint for interactive or scripted testing. Reference for -c, headers, sub… xargs -0xargs -0 reads NUL-separated items so filenames with spaces and newlines survive. Reference for pairing with… xargs -axargs -a reads its input items from a file instead of stdin, freeing the pipe for other use. Reference for th… xargs -dxargs -d sets the character that separates input items, for example a newline or a comma. Reference for the G… xargs -I {}xargs -I {} runs the command once per item and substitutes the item wherever you put the placeholder. Referen… xargs -Lxargs -L runs the command once for every N lines of input, treating lines rather than words as the unit. Refe… xargs -nxargs -n caps how many items go into each command invocation. Reference for batching, the difference from -L,… xargs -pxargs -p asks for confirmation before running each command, useful for risky bulk operations at a terminal. R… xargs -Pxargs -P runs multiple command invocations concurrently to use all CPU cores. Reference for combining -P with… xargs test shardsxargs -P fans test files out across parallel workers to cut CI wall-clock time. Reference for sharding patter… xargs -rxargs -r (--no-run-if-empty) stops xargs from running the command when stdin is empty. Reference for the GNU… xargs -txargs -t prints each command to stderr just before running it, making pipelines easy to debug. Reference for… xargs command not foundWhen xargs cannot find the command it runs, it prints its own No such file or directory error. Reference for… xargs basicsxargs reads items from stdin and builds command lines from them, the classic partner for find. Reference for… xargsxargs builds and runs commands from stdin in CI. Reference for -0, -n, -P, -I, and -r, plus the empty-input t… xargs exit statusxargs returns a defined non-zero exit status when a command fails, which lets a failed bulk step fail the bui… xargs GNU vs BSDGNU xargs (Linux) and BSD xargs (macOS) differ on -r, -d, -a, and empty-input behavior. Reference for writing… xargs delete filesUse find piped to xargs rm to delete large numbers of files without hitting the argument limit. Reference for… xargs curl per URLPipe a URL list into xargs curl to fetch or warm many endpoints, serially or in parallel. Reference for -n 1,… xargs bulk sedPipe a file list into xargs sed -i to apply an edit across many files at once. Reference for the safe codemod… xargsxargs builds and runs commands from stdin. Reference for -0, -n, -P, -I, -r, and the empty-input and "argumen… simctl bootxcrun simctl list and boot start an iOS Simulator on a macOS runner. Reference for list, boot, bootstatus, sh… simctl create / erasexcrun simctl create makes a fresh simulator and erase resets one to factory state. Reference for create, eras… xh --check-statusxh --check-status maps 4xx and 5xx responses onto non-zero exit codes so smoke tests fail the build. Referenc… xh (http client)xh is a fast Rust HTTP client with HTTPie-style syntax. Reference for the request syntax, --check-status, sin… xhxh is a fast, single-binary HTTP client with HTTPie-compatible syntax. Reference for xh GET and POST, field o… xq (XML)xq (from yq/xmlutils) converts XML to JSON and applies a jq filter. Reference for -x round-trips, attribute k… xsv index/joinxsv index speeds up random access and xsv join merges CSVs on a key column. Reference for xsv index, xsv join… xsv select/statsxsv is a fast Rust CSV toolkit for select, search, stats and headers. Reference for xsv select, xsv stats, xs… xxdxxd produces a canonical hex dump and, with -r, rebuilds a binary from hex. Reference for -l, -s, -p, -r, bui… xzxz compresses to .xz with LZMA2, the smallest of the common formats. Reference for -9, -T0 threads, -d, and t… xzcatxzcat decompresses .xz files to stdout without writing a file, the xz counterpart to zcat. Reference for pipi… yamllint (workflows)yamllint checks CI config YAML for indentation, key duplication, and formatting before a schema linter runs.… yesyes repeats a string forever to feed interactive prompts non-interactively. Reference for piping y, custom st… yjyj converts between YAML, TOML, JSON and HCL with direction flags. Reference for -yj, -tj, -jy, and the conve… yq front matteryq --front-matter processes the YAML front matter block in Markdown files while preserving the body. Referenc… yq -i writeyq -i edits a YAML file in place, assigning a new value at a path. Reference for the assignment operator, -i,… yq YAML to JSONyq -o=json converts YAML to JSON on stdout. Reference for -o/--output-format, -I indentation, and the anchor… yq JSON to YAMLyq -p=json parses JSON input so you can convert it to YAML or query it. Reference for -p/--input-format, comb… yqReference for yq: reading and editing YAML/JSON, -i in-place edits, -o output format, env() interpolation, an… yq env/strenvyq strenv(VAR) and env(VAR) read environment variables into expressions. Reference for the string-vs-typed di… yq eval-allyq eval-all loads every document into scope at once, enabling merges and cross-document logic. Reference for… yq eval (templating)yq eval injects env values and merges overlays to produce YAML, a lightweight templater. Reference for env(),… yq evalyq eval runs an expression against one document at a time and is the implicit default. Reference for eval, th… yq keys/lengthyq keys lists a map's keys and length counts elements, useful for guards and assertions in CI. Reference for… yq selectyq select(...) keeps only nodes matching a condition, like jq select. Reference for select, comparisons, has(… yq with_entriesyq to_entries, from_entries, and with_entries transform map keys and values as key/value pairs. Reference for… yq add/delete keysyq adds new keys with assignment and removes them with del(). Reference for creating nested keys, del() synta… yq anchorsyq reads YAML anchors and aliases and can inline them with explode. Reference for the && anchor / * alias syn… yq arraysyq indexes arrays, appends with += and [+], and deletes elements. Reference for [n], [-1], +=, [+], and the a… yq k8s image tagyq updates the container image in a Kubernetes manifest as part of a deploy pipeline. Reference for the conta… yq compose edityq reads and edits docker-compose.yml service fields like image, ports, and environment. Reference for the se… yq multi-documentyq processes multi-document YAML separated by --- per document or all at once. Reference for documentIndex, s… yq installInstalling yq on a runner is where snap, apt, pip, and the GitHub release binary collide. Reference for getti… yq merge (*)yq merges maps with the * (multiply) operator, deep-merging keys. Reference for *, *+, *? merge modifiers, lo… yq Go vs PythonTwo unrelated tools are both called yq. Reference for telling mikefarah/yq (Go) from kislyuk/yq (Python jq wr… yq output styleyq controls output style, quoting, and raw scalars with style operators and flags. Reference for double-quote… yq commentsyq keeps YAML comments through edits and can read, set, or strip them. Reference for comment operators, ... c… yq read pathyq reads a value at a dotted path from a YAML or JSON file and prints it. Reference for path expressions, the… yq GITHUB_OUTPUTyq reads a config value that a GitHub Actions step exposes via $GITHUB_OUTPUT. Reference for capturing scalar… yq stringsyq manipulates strings with split, join, sub, test, upcase, and format. Reference for the string operators us… yqyq is a YAML/JSON/XML processor with jq-like syntax. Reference for -i, eval, output formats, and the v3-vs-v4… ytt (Carvel)ytt (Carvel) templates YAML with Starlark and typed data values. Reference for -f, --data-value, --data-value… yumReference for yum: install, -y, remove, makecache, clean all, and a CI example that installs packages noninte… yum installyum install adds packages on RHEL 7, CentOS 7, and Amazon Linux. Reference for -y, clean all, and the "No pac… yum installyum install adds packages on CentOS 7 and older RHEL. Reference for -y, and the EOL-mirror "Could not resolve… zcatzcat streams the decompressed contents of .gz (and .Z) files to stdout without writing a file. Reference for… zgrepzgrep searches gzip-compressed files without decompressing them first, useful for rotated CI logs. Reference… zip --symlinkszip -y (--symlinks) stores symbolic links as links instead of following them. Reference for preserving symlin… zip -9zip -0 through -9 trade speed for size, and -9 gives maximum compression. Reference for choosing a level in C… zip -ezip -e prompts for a password and zip -P takes one inline to encrypt an archive. Reference for the weak ZipCr… zip -jzip -j stores only the file names, dropping their directory paths to flatten the archive. Reference for -j us… zip -q -Xzip -q silences output and zip -X strips extra metadata for reproducible archives. Reference for deterministi… zip -rzip -r packages a whole directory tree into a .zip archive. Reference for recursing into subdirectories and t… zip -szip -s splits an archive into multiple size-limited segments. Reference for split sizes, the .z01 part naming… zip -u -@zip -u updates an existing archive and zip -@ reads the file list from stdin. Reference for -u, -f freshen, -… zip -xzip -x excludes paths matching a pattern when building an archive. Reference for -x globs, quoting, and the n… zip/unzip errorszip and unzip are not preinstalled on many CI images, and downloads often are not valid zips. Reference for i… zipzip packs files into cross-platform .zip archives in CI. Reference for -r, -j, -q, and -x, plus the missing-b… Lambda zip packageAWS Lambda deployment packages are zip files with the handler at the top level and executable bits preserved.… zipzip packs files into a .zip archive. Reference for -r, -j, -q, -x, and the "command not found" and empty-arch… zizmorzizmor is a static security auditor for GitHub Actions workflows, flagging injection, unpinned actions, and d… zstdzstd compresses to .zst with a strong speed-to-ratio balance, ideal for build caches. Reference for -19, --lo… zstdcatzstdcat decompresses .zst files to stdout without writing a file, the zstd counterpart to zcat. Reference for… zypper installzypper --non-interactive install adds packages on openSUSE and SLES unattended. Reference for -n, --no-recomm…