refactor(api): remove deprecated attestation and bundle fields from Store

Closes #3055

The AttestationServiceStoreRequest previously carried three representations
of the same payload: the raw DSSE envelope, the original Sigstore bundle
(with the signature bug from #1832), and the fixed attestation bundle. Only
attestation_bundle is consumed today; the other two have been deprecated
since June 2025 and the fixed bundle has been available since February 2025.

This removes the deprecated fields and their fallback paths in the CLI,
controlplane service/biz/data layers, and the attestation helper package,
cutting the gRPC request size by ~3x for the same logical payload.

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

app/cli/pkg/action/attestation_push.go

@@ -263,7 +263,7 @@ func (action *AttestationPush) Run(ctx context.Context, attestationID string, ru
 
 	workflow := crafter.CraftingState.Attestation.GetWorkflow()
 
-	attestationResult.Digest, err = pushToControlPlane(ctx, action.CPConnection, envelope, bundle, workflow.GetWorkflowRunId(), workflow.GetVersion().GetMarkAsReleased())
+	attestationResult.Digest, err = pushToControlPlane(ctx, action.CPConnection, bundle, workflow.GetWorkflowRunId(), workflow.GetVersion().GetMarkAsReleased())
 	if err != nil {
 		return nil, fmt.Errorf("pushing to control plane: %w", err)
 	}
@@ -303,32 +303,17 @@ func (action *AttestationPush) saveBundle(bundle *protobundle.Bundle) error {
 	return nil
 }
 
-func pushToControlPlane(ctx context.Context, conn *grpc.ClientConn, envelope *dsse.Envelope, bundle *protobundle.Bundle, workflowRunID string, markVersionAsReleased bool) (string, error) {
-	encodedBundle, err := encodeBundle(bundle)
-	if err != nil {
-		return "", fmt.Errorf("encoding attestation: %w", err)
-	}
-
-	client := pb.NewAttestationServiceClient(conn)
-
-	// if endpoint doesn't accept the bundle, we still send the plain attestation for backwards compatibility
-	encodedAttestation, err := encodeEnvelope(envelope)
-	if err != nil {
-		return "", fmt.Errorf("encoding attestation: %w", err)
-	}
-
+func pushToControlPlane(ctx context.Context, conn *grpc.ClientConn, bundle *protobundle.Bundle, workflowRunID string, markVersionAsReleased bool) (string, error) {
 	// remove additional base64 encoding in signature. See https://github.com/chainloop-dev/chainloop/issues/1832
 	attestation.FixSignatureInBundle(bundle)
-	encodedFixedBundle, err := encodeBundle(bundle)
+	encodedBundle, err := encodeBundle(bundle)
 	if err != nil {
 		return "", fmt.Errorf("encoding attestation: %w", err)
 	}
 
-	// Store bundle next versions will perform this in a single call)
+	client := pb.NewAttestationServiceClient(conn)
 	resp, err := client.Store(ctx, &pb.AttestationServiceStoreRequest{
-		Attestation:           encodedAttestation,
-		Bundle:                encodedBundle,
-		AttestationBundle:     encodedFixedBundle,
+		AttestationBundle:     encodedBundle,
 		WorkflowRunId:         workflowRunID,
 		MarkVersionAsReleased: &markVersionAsReleased,
 	})
@@ -339,10 +324,6 @@ func pushToControlPlane(ctx context.Context, conn *grpc.ClientConn, envelope *ds
 	return resp.Result.Digest, nil
 }
 
-func encodeEnvelope(e *dsse.Envelope) ([]byte, error) {
-	return json.Marshal(e)
-}
-
 func encodeBundle(b *protobundle.Bundle) ([]byte, error) {
 	return protojson.Marshal(b)
 }

app/controlplane/api/controlplane/v1/workflow_run.pb.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -157,16 +157,15 @@ message AttestationServiceInitResponse {
 }
 
 message AttestationServiceStoreRequest {
-  // encoded DSEE envelope
-  bytes attestation = 1 [deprecated = true];
-  // deprecated because of https://github.com/chainloop-dev/chainloop/issues/1832
-  bytes bundle = 4 [deprecated = true];
   // encoded Sigstore attestation bundle
   bytes attestation_bundle = 5;
 
   string workflow_run_id = 2 [(buf.validate.field).string = {min_len: 1}];
   // mark the associated version as released
   optional bool mark_version_as_released = 3;
+
+  reserved 1, 4;
+  reserved "attestation", "bundle";
 }
 
 message AttestationServiceStoreResponse {

app/controlplane/api/controlplane/v1/workflow_run.proto

@@ -245,11 +245,7 @@ func (s *AttestationService) Store(ctx context.Context, req *cpAPI.AttestationSe
 
 	bundle := req.GetAttestationBundle()
 	if bundle == nil {
-		bundle = req.GetBundle()
-	}
-
-	if req.GetAttestation() == nil && bundle == nil {
-		return nil, errors.BadRequest("input required", "DSSE envelope or attestation bundle is required")
+		return nil, errors.BadRequest("input required", "attestation bundle is required")
 	}
 
 	// This will make sure the provided workflowRunID belongs to the org encoded in the robot account
@@ -274,7 +270,7 @@ func (s *AttestationService) Store(ctx context.Context, req *cpAPI.AttestationSe
 		return nil, errors.NotFound("not found", "workflow run has no CAS backend")
 	}
 
-	digest, err := s.storeAttestation(ctx, req.GetAttestation(), bundle, robotAccount, wf, wRun, req.MarkVersionAsReleased)
+	digest, err := s.storeAttestation(ctx, bundle, robotAccount, wf, wRun, req.MarkVersionAsReleased)
 	if err != nil {
 		return nil, handleUseCaseErr(err, s.log)
 	}
@@ -284,19 +280,19 @@ func (s *AttestationService) Store(ctx context.Context, req *cpAPI.AttestationSe
 	}, nil
 }
 
-// Stores and process a DSSE Envelope with a Chainloop attestation
-func (s *AttestationService) storeAttestation(ctx context.Context, envelope []byte, bundle []byte, robotAccount *usercontext.RobotAccount, wf *biz.Workflow, wfRun *biz.WorkflowRun, markAsReleased *bool) (*v1.Hash, error) {
+// storeAttestation stores and processes a Sigstore attestation bundle.
+func (s *AttestationService) storeAttestation(ctx context.Context, bundle []byte, robotAccount *usercontext.RobotAccount, wf *biz.Workflow, wfRun *biz.WorkflowRun, markAsReleased *bool) (*v1.Hash, error) {
 	workflowRunID := wfRun.ID.String()
 	casBackend := wfRun.CASBackends[0]
 
 	// extract structured envelope for integrations
-	dsseEnv, err := attestation.DSSEEnvelopeFromRaw(bundle, envelope)
+	dsseEnv, err := attestation.DSSEEnvelopeFromBundleBytes(bundle)
 	if err != nil {
 		return nil, handleUseCaseErr(err, s.log)
 	}
 
 	// Store the attestation
-	digest, err := s.wrUseCase.SaveAttestation(ctx, workflowRunID, envelope, bundle)
+	digest, err := s.wrUseCase.SaveAttestation(ctx, workflowRunID, bundle)
 	if err != nil {
 		return nil, handleUseCaseErr(err, s.log)
 	}
@@ -315,15 +311,9 @@ func (s *AttestationService) storeAttestation(ctx context.Context, envelope []by
 			b.MaxElapsedTime = 1 * time.Minute
 			err := backoff.Retry(
 				func() error {
-					rawContent := bundle
-					if rawContent == nil {
-						rawContent = envelope
-					}
-
 					// reset context
 					ctx := context.Background()
-					var err error
-					if err = s.attestationUseCase.UploadAttestationToCAS(ctx, rawContent, casBackend, workflowRunID, *digest); err != nil {
+					if err := s.attestationUseCase.UploadAttestationToCAS(ctx, bundle, casBackend, workflowRunID, *digest); err != nil {
 						return err
 					}