feat(policies): surface suppressed violations + finding data on describe API (#3105)

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

app/cli/cmd/workflow_workflow_run_describe.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,12 +20,14 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net/url"
 	"os"
 	"strings"
 	"time"
 
 	"github.com/chainloop-dev/chainloop/app/cli/cmd/output"
 	"github.com/chainloop-dev/chainloop/app/cli/pkg/action"
+	attv1 "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer/chainloop"
 	"github.com/jedib0t/go-pretty/v6/table"
 	"github.com/jedib0t/go-pretty/v6/text"
@@ -221,7 +223,7 @@ func predicateV1Table(att *action.WorkflowRunAttestationItem) {
 			if len(m.Annotations) > 0 {
 				mt.AppendRow(table.Row{"Annotations", "------"})
 				for _, a := range m.Annotations {
-					mt.AppendRow(table.Row{"", fmt.Sprintf("%s: %s", a.Name, a.Value)})
+					mt.AppendRow(table.Row{"", wrap.String(fmt.Sprintf("%s: %s", a.Name, a.Value), 100)})
 				}
 			}
 			evs := att.PolicyEvaluations[m.Name]
@@ -266,24 +268,29 @@ func policiesTable(evs []*action.PolicyEvaluation, mt table.Writer, debugMode bo
 			}
 		case len(ev.Violations) == 0:
 			msg = text.Colors{text.FgHiGreen}.Sprint("Ok")
-		case len(ev.Violations) > 0:
-			color := text.Colors{text.FgHiRed}
-			var violations []string
-			var prefix = ""
+		default:
+			hasActive := false
+			lines := make([]string, 0, len(ev.Violations))
 			for _, v := range ev.Violations {
-				violations = append(violations, v.Message)
-			}
-			// For multiple violations, we want to indent the list
-			if len(violations) > 1 {
-				prefix = "\n  - "
+				color := text.FgHiRed
+				if v.Suppress {
+					color = text.FgHiYellow
+				} else {
+					hasActive = true
+				}
+				lines = append(lines, text.Colors{color}.Sprint(violationSummary(v)))
 			}
-
-			// Color the violations text before joining
-			for i, v := range violations {
-				violations[i] = color.Sprint(v)
+			// When every finding is suppressed the gate passed; lead with
+			// "Ok" so the row carries the same signal as the no-violations
+			// case rather than reading like a failure.
+			switch {
+			case !hasActive:
+				msg = text.Colors{text.FgHiGreen}.Sprint("Ok") + "\n  - " + strings.Join(lines, "\n  - ")
+			case len(lines) == 1:
+				msg = lines[0]
+			default:
+				msg = "\n  - " + strings.Join(lines, "\n  - ")
 			}
-
-			msg = prefix + strings.Join(violations, prefix)
 		}
 
 		name := ev.Name
@@ -294,6 +301,125 @@ func policiesTable(evs []*action.PolicyEvaluation, mt table.Writer, debugMode bo
 	}
 }
 
+// violationSummary builds a single-line description of a violation using the
+// structured finding when present (CVE id + severity + package + fix info,
+// or SAST rule + location, or license + component). Falls back to the first
+// line of Message — vuln policies emit a multi-line markdown report there
+// which would otherwise break the row layout. The resolved assessment
+// status, if any, is appended inside the same severity-parens regardless
+// of suppression so AFFECTED / UNDER_INVESTIGATION / etc. surface on
+// active findings too.
+func violationSummary(v *action.PolicyViolation) string {
+	statusTag := prettyAssessmentStatus(violationAssessment(v).GetEffectiveStatus())
+	if statusTag == "" && v.Suppress {
+		statusTag = "suppressed"
+	}
+
+	switch {
+	case v.Vulnerability != nil:
+		f := v.Vulnerability
+		head := f.GetExternalId()
+		if tag := joinTag(f.GetSeverity(), statusTag); tag != "" {
+			head = fmt.Sprintf("%s (%s)", head, tag)
+		}
+		if pkg := prettyPurl(f.GetPackagePurl()); pkg != "" {
+			head += " " + pkg
+		}
+		if fix := f.GetFixedVersion(); fix != "" {
+			head += " [fix: " + fix + "]"
+		}
+		return head
+	case v.Sast != nil:
+		f := v.Sast
+		out := f.GetRuleId()
+		if tag := joinTag(f.GetSeverity(), statusTag); tag != "" {
+			out = fmt.Sprintf("%s (%s)", out, tag)
+		}
+		if loc := f.GetLocation(); loc != "" {
+			if ln := f.GetLineNumber(); ln > 0 {
+				out = fmt.Sprintf("%s at %s:%d", out, loc, ln)
+			} else {
+				out = fmt.Sprintf("%s at %s", out, loc)
+			}
+		}
+		return out
+	case v.LicenseViolation != nil:
+		f := v.LicenseViolation
+		out := f.GetLicenseId()
+		if statusTag != "" {
+			out = fmt.Sprintf("%s (%s)", out, statusTag)
+		}
+		if c := f.GetComponentName(); c != "" {
+			if ver := f.GetComponentVersion(); ver != "" {
+				out = fmt.Sprintf("%s — %s@%s", out, c, ver)
+			} else {
+				out = fmt.Sprintf("%s — %s", out, c)
+			}
+		}
+		return out
+	}
+	head := strings.SplitN(strings.TrimSpace(v.Message), "\n", 2)[0]
+	if head == "" {
+		head = v.Subject
+	}
+	if statusTag != "" {
+		head = fmt.Sprintf("%s (%s)", head, statusTag)
+	}
+	return head
+}
+
+// joinTag combines severity and the assessment status into the
+// comma-separated parenthetical shown after the finding id.
+func joinTag(severity, status string) string {
+	sev := strings.ToUpper(severity)
+	switch {
+	case sev != "" && status != "":
+		return sev + ", " + status
+	case sev != "":
+		return sev
+	default:
+		return status
+	}
+}
+
+// violationAssessment returns the assessment attached to whichever structured
+// finding the violation carries, or nil. Centralizes the type dispatch.
+func violationAssessment(v *action.PolicyViolation) *attv1.PolicyAssessmentResult {
+	switch {
+	case v.Vulnerability != nil:
+		return v.Vulnerability.GetAssessment()
+	case v.Sast != nil:
+		return v.Sast.GetAssessment()
+	case v.LicenseViolation != nil:
+		return v.LicenseViolation.GetAssessment()
+	}
+	return nil
+}
+
+func prettyAssessmentStatus(s string) string {
+	return strings.TrimPrefix(s, "ASSESSMENT_STATUS_")
+}
+
+// prettyPurl shortens "pkg:type/[namespace/]name@version[?qualifiers][#sub]"
+// to "name@version" with percent-decoding applied — PURL requires `+` in
+// version strings to be encoded as %2B, which is unreadable in CLI output.
+func prettyPurl(purl string) string {
+	if purl == "" {
+		return ""
+	}
+	s := strings.TrimPrefix(purl, "pkg:")
+	if i := strings.IndexAny(s, "?#"); i >= 0 {
+		s = s[:i]
+	}
+	if i := strings.LastIndex(s, "/"); i >= 0 {
+		s = s[i+1:]
+	}
+	if decoded, err := url.PathUnescape(s); err == nil {
+		s = decoded
+	}
+	return s
+}
+
 func encodeAttestationOutput(run *action.WorkflowRunItemFull, writer io.Writer) error {
 	// Try to encode as a table or json
 	err := output.EncodeOutput(flagOutputFormat, run, workflowRunDescribeTableOutput)

app/cli/cmd/workflow_workflow_run_describe_test.go

@@ -21,7 +21,9 @@ import (
 	"testing"
 
 	"github.com/chainloop-dev/chainloop/app/cli/pkg/action"
+	attv1 "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/suite"
 )
 
@@ -47,6 +49,154 @@ func (s *workflowRunDescribeSuite) SetupTest() {
 	}
 }
 
+func TestViolationSummary(t *testing.T) {
+	tests := []struct {
+		name      string
+		violation *action.PolicyViolation
+		want      string
+	}{
+		{
+			name: "vulnerability with severity and package, no fix",
+			violation: &action.PolicyViolation{
+				Vulnerability: &attv1.PolicyVulnerabilityFinding{
+					ExternalId:  "CVE-2026-5450",
+					Severity:    "critical",
+					PackagePurl: "pkg:deb/debian/libc6@2.41-12%2Bdeb13u2",
+				},
+			},
+			want: "CVE-2026-5450 (CRITICAL) libc6@2.41-12+deb13u2",
+		},
+		{
+			name: "vulnerability with fix version",
+			violation: &action.PolicyViolation{
+				Vulnerability: &attv1.PolicyVulnerabilityFinding{
+					ExternalId:   "CVE-2024-9999",
+					Severity:     "high",
+					PackagePurl:  "pkg:golang/example.com/lib@v1.0.0",
+					FixedVersion: "1.0.1",
+				},
+			},
+			want: "CVE-2024-9999 (HIGH) lib@v1.0.0 [fix: 1.0.1]",
+		},
+		{
+			name: "active vulnerability surfaces assessment status (AFFECTED)",
+			violation: &action.PolicyViolation{
+				Vulnerability: &attv1.PolicyVulnerabilityFinding{
+					ExternalId:  "CVE-2024-1",
+					Severity:    "high",
+					PackagePurl: "pkg:deb/debian/libc6@2.41",
+					Assessment: &attv1.PolicyAssessmentResult{
+						EffectiveStatus: "ASSESSMENT_STATUS_AFFECTED",
+					},
+				},
+			},
+			want: "CVE-2024-1 (HIGH, AFFECTED) libc6@2.41",
+		},
+		{
+			name: "active vulnerability surfaces assessment status (UNDER_INVESTIGATION)",
+			violation: &action.PolicyViolation{
+				Vulnerability: &attv1.PolicyVulnerabilityFinding{
+					ExternalId:  "CVE-2024-2",
+					Severity:    "medium",
+					PackagePurl: "pkg:deb/debian/libc6@2.41",
+					Assessment: &attv1.PolicyAssessmentResult{
+						EffectiveStatus: "ASSESSMENT_STATUS_UNDER_INVESTIGATION",
+					},
+				},
+			},
+			want: "CVE-2024-2 (MEDIUM, UNDER_INVESTIGATION) libc6@2.41",
+		},
+		{
+			name: "suppressed vulnerability gets assessment status inline",
+			violation: &action.PolicyViolation{
+				Suppress: true,
+				Vulnerability: &attv1.PolicyVulnerabilityFinding{
+					ExternalId:  "CVE-2018-XXXX",
+					Severity:    "low",
+					PackagePurl: "pkg:deb/debian/libc6@2.41",
+					Assessment: &attv1.PolicyAssessmentResult{
+						EffectiveStatus: "ASSESSMENT_STATUS_NOT_AFFECTED",
+					},
+				},
+			},
+			want: "CVE-2018-XXXX (LOW, NOT_AFFECTED) libc6@2.41",
+		},
+		{
+			name: "SAST with location and line number",
+			violation: &action.PolicyViolation{
+				Sast: &attv1.PolicySASTFinding{
+					RuleId:     "go-sec:G101",
+					Severity:   "medium",
+					Location:   "internal/auth.go",
+					LineNumber: 42,
+				},
+			},
+			want: "go-sec:G101 (MEDIUM) at internal/auth.go:42",
+		},
+		{
+			name: "license violation with component and version",
+			violation: &action.PolicyViolation{
+				LicenseViolation: &attv1.PolicyLicenseViolationFinding{
+					LicenseId:        "GPL-3.0",
+					ComponentName:    "lodash",
+					ComponentVersion: "4.17.21",
+				},
+			},
+			want: "GPL-3.0 — lodash@4.17.21",
+		},
+		{
+			name: "unstructured policy uses first line of message",
+			violation: &action.PolicyViolation{
+				Subject: "repo",
+				Message: "missing VEX material",
+			},
+			want: "missing VEX material",
+		},
+		{
+			name: "unstructured suppressed without assessment falls back to literal tag",
+			violation: &action.PolicyViolation{
+				Suppress: true,
+				Subject:  "repo",
+				Message:  "missing VEX material",
+			},
+			want: "missing VEX material (suppressed)",
+		},
+		{
+			name: "unstructured multi-line message keeps only first line",
+			violation: &action.PolicyViolation{
+				Subject: "x",
+				Message: "first line\nsecond line\nthird line",
+			},
+			want: "first line",
+		},
+		{
+			name: "empty message falls back to subject",
+			violation: &action.PolicyViolation{
+				Subject: "missing-tag-annotation",
+				Message: "",
+			},
+			want: "missing-tag-annotation",
+		},
+		{
+			name: "vulnerability with purl qualifiers strips them",
+			violation: &action.PolicyViolation{
+				Vulnerability: &attv1.PolicyVulnerabilityFinding{
+					ExternalId:  "CVE-2024-3",
+					Severity:    "high",
+					PackagePurl: "pkg:deb/debian/libc6@2.41?arch=amd64",
+				},
+			},
+			want: "CVE-2024-3 (HIGH) libc6@2.41",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, violationSummary(tc.violation))
+		})
+	}
+}
+
 func (s *workflowRunDescribeSuite) TestOutputTypePayload() {
 	flagOutputFormat = formatPayloadPAE
 	expected := "DSSEv1 28 application/vnd.in-toto+json 5 hello"

app/cli/pkg/action/attestation_status.go

@@ -366,11 +366,20 @@ func policyEvaluationStateToActionForStatus(in *v1.PolicyEvaluation) *PolicyEval
 
 	violations := make([]*PolicyViolation, 0, len(in.Violations))
 	for _, v := range in.Violations {
-		violations = append(violations, &PolicyViolation{
+		out := &PolicyViolation{
 			Subject:  v.Subject,
 			Message:  v.Message,
 			Suppress: v.GetSuppress(),
-		})
+		}
+		switch f := v.GetFinding().(type) {
+		case *v1.PolicyEvaluation_Violation_Vulnerability:
+			out.Vulnerability = f.Vulnerability
+		case *v1.PolicyEvaluation_Violation_Sast:
+			out.Sast = f.Sast
+		case *v1.PolicyEvaluation_Violation_LicenseViolation:
+			out.LicenseViolation = f.LicenseViolation
+		}
+		violations = append(violations, out)
 	}
 
 	return &PolicyEvaluation{