fix(controlplane): replace variadic publisher option with publish-only constructor

wire cannot resolve variadic providers: the CI generate check failed
because NewAuditLogPublisher's new variadic options parameter made wire
demand a []auditor.PublisherOption provider in the controlplane and
testhelpers injectors. Restore the original NewAuditLogPublisher
signature and expose the publish-only mode as a separate wire-friendly
NewPublishOnlyAuditLogPublisher constructor used directly by the CAS.

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Chainloop-Trace-Sessions: 0c60a332-e0f1-4c2b-94ae-533467e52f5c

Author: migmartri

app/artifact-cas/cmd/wire.go

@@ -21,8 +21,6 @@
 package main
 
 import (
-	"context"
-
 	"github.com/chainloop-dev/chainloop/app/artifact-cas/internal/conf"
 	"github.com/chainloop-dev/chainloop/app/artifact-cas/internal/server"
 	"github.com/chainloop-dev/chainloop/app/artifact-cas/internal/service"
@@ -46,7 +44,8 @@ func wireApp(*conf.Bootstrap, *conf.Server, *conf.Auth, credentials.Reader, log.
 			newProtoValidator,
 			newNatsConfig,
 			natsconn.New,
-			newAuditLogPublisher,
+			// publish-only: the control plane owns the chainloop-audit stream configuration
+			auditor.NewPublishOnlyAuditLogPublisher,
 			service.NewAuditDispatcher,
 		),
 	)
@@ -77,9 +76,3 @@ func newNatsConfig(bc *conf.Bootstrap) *natsconn.Config {
 
 	return cfg
 }
-
-// newAuditLogPublisher creates a publish-only audit log publisher: the control
-// plane owns the chainloop-audit stream configuration, the CAS only publishes to it
-func newAuditLogPublisher(rc *natsconn.ReloadableConnection, logger log.Logger) (*auditor.AuditLogPublisher, error) {
-	return auditor.NewAuditLogPublisher(context.Background(), rc, logger, auditor.WithoutStreamManagement())
-}

app/artifact-cas/cmd/wire_gen.go

@@ -41,48 +41,45 @@ type AuditLogPublisher struct {
 	logger *log.Helper
 }
 
-type PublisherOption func(*publisherOptions)
+// NewAuditLogPublisher creates a publisher that owns the JetStream stream:
+// it creates or updates it on boot and after every NATS reconnection.
+func NewAuditLogPublisher(ctx context.Context, rc *natsconn.ReloadableConnection, logger log.Logger) (*AuditLogPublisher, error) {
+	p := newPublisher(rc, logger)
+	if p == nil {
+		return nil, nil
+	}
 
-type publisherOptions struct {
-	withoutStreamManagement bool
+	if err := p.initJetStream(); err != nil {
+		return nil, err
+	}
+
+	go p.watchReconnect(rc.Subscribe(ctx))
+
+	return p, nil
 }
 
-// WithoutStreamManagement makes the publisher publish-only: it never creates or
-// updates the JetStream stream. Meant for components (e.g. the Artifact CAS) that
-// publish to the stream owned and configured by the control plane, so they can't
-// accidentally override its configuration (e.g. downgrade the replica count).
-func WithoutStreamManagement() PublisherOption {
-	return func(o *publisherOptions) {
-		o.withoutStreamManagement = true
+// NewPublishOnlyAuditLogPublisher creates a publisher that never creates or
+// updates the JetStream stream. Meant for components (e.g. the Artifact CAS)
+// that publish to the stream owned and configured by the control plane, so they
+// can't accidentally override its configuration (e.g. downgrade the replica count).
+func NewPublishOnlyAuditLogPublisher(rc *natsconn.ReloadableConnection, logger log.Logger) (*AuditLogPublisher, error) {
+	p := newPublisher(rc, logger)
+	if p != nil {
+		p.logger.Infow("msg", "stream management disabled, running in publish-only mode")
 	}
+
+	return p, nil
 }
 
-func NewAuditLogPublisher(ctx context.Context, rc *natsconn.ReloadableConnection, logger log.Logger, opts ...PublisherOption) (*AuditLogPublisher, error) {
+// newPublisher returns nil when NATS is not configured (the publisher is disabled)
+func newPublisher(rc *natsconn.ReloadableConnection, logger log.Logger) *AuditLogPublisher {
 	l := log.NewHelper(log.With(logger, "component", "natsAuditLogPublisher"))
 	if rc == nil {
 		l.Infow("msg", "NATS connection not set, audit log publisher disabled")
-		return nil, nil
-	}
-
-	options := &publisherOptions{}
-	for _, opt := range opts {
-		opt(options)
-	}
-
-	p := &AuditLogPublisher{rc: rc, logger: l}
-
-	if options.withoutStreamManagement {
-		l.Infow("msg", "stream management disabled, running in publish-only mode")
-		return p, nil
-	}
-
-	if err := p.initJetStream(); err != nil {
-		return nil, err
+		return nil
 	}
 
-	go p.watchReconnect(rc.Subscribe(ctx))
-
-	return p, nil
+	return &AuditLogPublisher{rc: rc, logger: l}
 }
 
 func (p *AuditLogPublisher) initJetStream() error {

app/controlplane/pkg/auditor/nats.go

@@ -27,35 +27,42 @@ import (
 
 func TestNewAuditLogPublisher(t *testing.T) {
 	tests := []struct {
-		name string
-		rc   *natsconn.ReloadableConnection
-		opts []PublisherOption
+		name        string
+		rc          *natsconn.ReloadableConnection
+		constructor func(*natsconn.ReloadableConnection) (*AuditLogPublisher, error)
 		// nil publisher means disabled (no NATS configured)
 		wantNil bool
 	}{
 		{
-			name:    "nil connection disables the publisher",
-			rc:      nil,
+			name: "nil connection disables the publisher",
+			rc:   nil,
+			constructor: func(rc *natsconn.ReloadableConnection) (*AuditLogPublisher, error) {
+				return NewAuditLogPublisher(context.Background(), rc, log.DefaultLogger)
+			},
 			wantNil: true,
 		},
 		{
-			name:    "nil connection with options still disables the publisher",
-			rc:      nil,
-			opts:    []PublisherOption{WithoutStreamManagement()},
+			name: "nil connection disables the publish-only publisher",
+			rc:   nil,
+			constructor: func(rc *natsconn.ReloadableConnection) (*AuditLogPublisher, error) {
+				return NewPublishOnlyAuditLogPublisher(rc, log.DefaultLogger)
+			},
 			wantNil: true,
 		},
 		{
 			// publish-only mode skips stream creation/updates so it doesn't
 			// need a live JetStream context at construction time
 			name: "publish-only mode skips stream management",
 			rc:   &natsconn.ReloadableConnection{},
-			opts: []PublisherOption{WithoutStreamManagement()},
+			constructor: func(rc *natsconn.ReloadableConnection) (*AuditLogPublisher, error) {
+				return NewPublishOnlyAuditLogPublisher(rc, log.DefaultLogger)
+			},
 		},
 	}
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			p, err := NewAuditLogPublisher(context.Background(), tc.rc, log.DefaultLogger, tc.opts...)
+			p, err := tc.constructor(tc.rc)
 			require.NoError(t, err)
 			if tc.wantNil {
 				assert.Nil(t, p)