feat(cli): send CLI version on every request and forward it to policy providers (#3088)

migmartri · web-flow · commit 2d79db62e889 · 2026-05-04T22:27:50.000+02:00
Signed-off-by: Miguel Martinez Trivino &lt;miguel@chainloop.dev&gt;
diff --git a/app/cli/cmd/artifact.go b/app/cli/cmd/artifact.go
@@ -53,6 +53,7 @@ func wrappedArtifactConn(cpConn *grpc.ClientConn, role pb.CASCredentialsServiceG
 
 	var opts = []grpcconn.Option{
 		grpcconn.WithInsecure(apiInsecure()),
+		grpcconn.WithCLIVersion(fullVersion()),
 	}
 
 	if caValue := viper.GetString(confOptions.CASCA.viperKey); caValue != "" {
diff --git a/app/cli/cmd/root.go b/app/cli/cmd/root.go
@@ -134,6 +134,7 @@ func NewRootCmd(l zerolog.Logger) *cobra.Command {
 
 			var opts = []grpcconn.Option{
 				grpcconn.WithInsecure(apiInsecure()),
+				grpcconn.WithCLIVersion(fullVersion()),
 			}
 
 			if caValue := viper.GetString(confOptions.controlplaneCA.viperKey); caValue != "" {
@@ -369,7 +370,7 @@ func initConfigFile() {
 }
 
 func newActionOpts(logger zerolog.Logger, conn *grpc.ClientConn, token string) *action.ActionsOpts {
-	return &action.ActionsOpts{CPConnection: conn, Logger: logger, AuthTokenRaw: token, OutputFormat: flagOutputFormat}
+	return &action.ActionsOpts{CPConnection: conn, Logger: logger, AuthTokenRaw: token, OutputFormat: flagOutputFormat, CLIVersion: fullVersion()}
 }
 
 func cleanup(conn *grpc.ClientConn) error {
diff --git a/app/cli/cmd/version.go b/app/cli/cmd/version.go
@@ -36,6 +36,13 @@ var (
 	Edition = ossEdition
 )
 
+// fullVersion returns the CLI version annotated with its edition flavor,
+// e.g. "v1.94.2-oss" or "dev-ee". Used as the value of the Chainloop-Cli-Version
+// header sent on every request to the Control Plane and CAS.
+func fullVersion() string {
+	return Version + "-" + Edition
+}
+
 type info struct {
 	Version string
 	Digest  string
diff --git a/app/cli/pkg/action/action.go b/app/cli/pkg/action/action.go
@@ -59,6 +59,7 @@ type ActionsOpts struct {
 	Logger       zerolog.Logger
 	AuthTokenRaw string
 	OutputFormat string
+	CLIVersion   string
 }
 
 type OffsetPagination struct {
@@ -113,7 +114,7 @@ func newCrafter(stateOpts *newCrafterStateOpts, conn *grpc.ClientConn, opts ...c
 }
 
 // getCASBackend tries to get CAS upload credentials and set up a CAS client
-func getCASBackend(ctx context.Context, client pb.AttestationServiceClient, workflowRunID, casCAPath, casURI string, casConnectionInsecure bool, logger zerolog.Logger, casBackend *casclient.CASBackend) (*clientAPI.Attestation_CASBackend, func() error, error) {
+func getCASBackend(ctx context.Context, client pb.AttestationServiceClient, workflowRunID, casCAPath, casURI string, casConnectionInsecure bool, logger zerolog.Logger, casBackend *casclient.CASBackend, cliVersion string) (*clientAPI.Attestation_CASBackend, func() error, error) {
 	credsResp, err := client.GetUploadCreds(ctx, &pb.AttestationServiceGetUploadCredsRequest{
 		WorkflowRunId: workflowRunID,
 	})
@@ -151,7 +152,10 @@ func getCASBackend(ctx context.Context, client pb.AttestationServiceClient, work
 		return casBackendInfo, nil, nil
 	}
 
-	opts := []grpcconn.Option{grpcconn.WithInsecure(casConnectionInsecure)}
+	opts := []grpcconn.Option{
+		grpcconn.WithInsecure(casConnectionInsecure),
+		grpcconn.WithCLIVersion(cliVersion),
+	}
 	if casCAPath != "" {
 		// Check if it's a file path or content. If it's a file path, it should exist. If not, treat it as content.
 		if _, err := os.Stat(casCAPath); err == nil {
diff --git a/app/cli/pkg/action/attestation_add.go b/app/cli/pkg/action/attestation_add.go
@@ -104,7 +104,7 @@ func (action *AttestationAdd) Run(ctx context.Context, attestationID, materialNa
 	if !crafter.CraftingState.GetDryRun() {
 		client := pb.NewAttestationServiceClient(action.CPConnection)
 		workflowRunID := crafter.CraftingState.GetAttestation().GetWorkflow().GetWorkflowRunId()
-		_, connectionCloserFn, getCASBackendErr := getCASBackend(ctx, client, workflowRunID, action.casCAPath, action.casURI, action.connectionInsecure, action.Logger, casBackend)
+		_, connectionCloserFn, getCASBackendErr := getCASBackend(ctx, client, workflowRunID, action.casCAPath, action.casURI, action.connectionInsecure, action.Logger, casBackend, action.CLIVersion)
 		if getCASBackendErr != nil {
 			return nil, fmt.Errorf("failed to get CAS backend: %w", getCASBackendErr)
 		}
diff --git a/app/cli/pkg/action/attestation_init.go b/app/cli/pkg/action/attestation_init.go
@@ -250,7 +250,7 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 	var casBackendInfo *clientAPI.Attestation_CASBackend
 	if !action.dryRun && attestationID != "" {
 		var connectionCloserFn func() error
-		casBackendInfo, connectionCloserFn, err = getCASBackend(ctx, client, attestationID, action.casCAPath, action.casURI, action.connectionInsecure, action.Logger, casBackend)
+		casBackendInfo, connectionCloserFn, err = getCASBackend(ctx, client, attestationID, action.casCAPath, action.casURI, action.connectionInsecure, action.Logger, casBackend, action.CLIVersion)
 		if err != nil {
 			// We don't want to fail the attestation initialization if CAS setup fails, it's a best-effort feature for PR/MR metadata
 			action.Logger.Warn().Err(err).Msg("unexpected error getting CAS backend")
diff --git a/app/cli/pkg/action/attestation_push.go b/app/cli/pkg/action/attestation_push.go
@@ -222,7 +222,7 @@ func (action *AttestationPush) Run(ctx context.Context, attestationID string, ru
 	if evaluations := crafter.CraftingState.GetAttestation().GetPolicyEvaluations(); !crafter.CraftingState.DryRun && len(evaluations) > 0 {
 		casBackend := &casclient.CASBackend{Name: "not-set"}
 		workflowRunID := crafter.CraftingState.GetAttestation().GetWorkflow().GetWorkflowRunId()
-		_, connectionCloserFn, getCASErr := getCASBackend(ctx, attClient, workflowRunID, action.casCAPath, action.casURI, action.connectionInsecure, action.Logger, casBackend)
+		_, connectionCloserFn, getCASErr := getCASBackend(ctx, attClient, workflowRunID, action.casCAPath, action.casURI, action.connectionInsecure, action.Logger, casBackend, action.CLIVersion)
 		if connectionCloserFn != nil {
 			// nolint: errcheck
 			defer connectionCloserFn()
diff --git a/app/controlplane/internal/service/attestation.go b/app/controlplane/internal/service/attestation.go
@@ -492,7 +492,7 @@ func (s *AttestationService) GetPolicy(ctx context.Context, req *cpAPI.Attestati
 		return nil, errors.Forbidden("forbidden", "organization not found")
 	}
 
-	remotePolicy, err := s.workflowContractUseCase.GetPolicy(req.GetProvider(), req.GetPolicyName(), req.GetOrgName(), org.Name, token.Token)
+	remotePolicy, err := s.workflowContractUseCase.GetPolicy(ctx, req.GetProvider(), req.GetPolicyName(), req.GetOrgName(), org.Name, token.Token)
 	if err != nil {
 		return nil, handleUseCaseErr(err, s.log)
 	}
@@ -514,7 +514,7 @@ func (s *AttestationService) GetPolicyGroup(ctx context.Context, req *cpAPI.Atte
 		return nil, errors.Forbidden("forbidden", "organization not found")
 	}
 
-	remoteGroup, err := s.workflowContractUseCase.GetPolicyGroup(req.GetProvider(), req.GetGroupName(), req.GetOrgName(), org.Name, token.Token)
+	remoteGroup, err := s.workflowContractUseCase.GetPolicyGroup(ctx, req.GetProvider(), req.GetGroupName(), req.GetOrgName(), org.Name, token.Token)
 	if err != nil {
 		return nil, handleUseCaseErr(err, s.log)
 	}
@@ -732,7 +732,7 @@ func (s *AttestationService) FindOrCreateWorkflow(ctx context.Context, req *cpAP
 
 	// contract validation
 	if req.GetContractBytes() != nil {
-		if err = s.workflowContractUseCase.ValidateContractPolicies(req.GetContractBytes(), token); err != nil {
+		if err = s.workflowContractUseCase.ValidateContractPolicies(ctx, req.GetContractBytes(), token); err != nil {
 			return nil, handleUseCaseErr(err, s.log)
 		}
 	}
diff --git a/app/controlplane/internal/service/workflowcontract.go b/app/controlplane/internal/service/workflowcontract.go
@@ -146,7 +146,7 @@ func (s *WorkflowContractService) Create(ctx context.Context, req *pb.WorkflowCo
 	}
 
 	if len(req.RawContract) != 0 {
-		if err = s.contractUseCase.ValidateContractPolicies(req.RawContract, token); err != nil {
+		if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawContract, token); err != nil {
 			return nil, handleUseCaseErr(err, s.log)
 		}
 	}
@@ -212,7 +212,7 @@ func (s *WorkflowContractService) Update(ctx context.Context, req *pb.WorkflowCo
 
 	// Validate the contract policies if the raw contract is provided
 	if len(req.RawContract) != 0 {
-		if err = s.contractUseCase.ValidateContractPolicies(req.RawContract, token); err != nil {
+		if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawContract, token); err != nil {
 			return nil, handleUseCaseErr(err, s.log)
 		}
 	}
@@ -251,7 +251,7 @@ func (s *WorkflowContractService) Apply(ctx context.Context, req *pb.WorkflowCon
 		return nil, err
 	}
 
-	if err = s.contractUseCase.ValidateContractPolicies(req.RawSchema, token); err != nil {
+	if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawSchema, token); err != nil {
 		return nil, handleUseCaseErr(err, s.log)
 	}
 
diff --git a/app/controlplane/internal/usercontext/entities/entitites.go b/app/controlplane/internal/usercontext/entities/entitites.go
@@ -1,5 +1,5 @@
 //
-// Copyright 2025 The Chainloop Authors.
+// Copyright 2025-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ import (
 	"context"
 	"strings"
 
+	"github.com/chainloop-dev/chainloop/pkg/grpcconn"
 	"github.com/go-kratos/kratos/v2/middleware/auth/jwt"
 	"github.com/go-kratos/kratos/v2/transport"
 )
@@ -46,3 +47,15 @@ func GetOrganizationNameFromHeader(ctx context.Context) (string, error) {
 
 	return "", nil
 }
+
+// GetCLIVersionFromHeader returns the CLI version advertised by the caller in
+// the Chainloop-Cli-Version request header. The value format is
+// "<version>-<edition>", e.g. "v1.94.2-oss". Returns an empty string when the
+// header is absent or there is no transport in the context.
+func GetCLIVersionFromHeader(ctx context.Context) string {
+	header, ok := transport.FromServerContext(ctx)
+	if !ok {
+		return ""
+	}
+	return header.RequestHeader().Get(grpcconn.CLIVersionHeader)
+}
diff --git a/app/controlplane/internal/usercontext/entities/entitites_test.go b/app/controlplane/internal/usercontext/entities/entitites_test.go
@@ -0,0 +1,72 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package entities
+
+import (
+	"context"
+	"testing"
+
+	"github.com/chainloop-dev/chainloop/pkg/grpcconn"
+	"github.com/go-kratos/kratos/v2/transport"
+	"github.com/stretchr/testify/assert"
+)
+
+type mockHeader map[string]string
+
+func (h mockHeader) Get(key string) string { return h[key] }
+func (h mockHeader) Set(key, value string) { h[key] = value }
+func (h mockHeader) Add(key, value string) { h[key] = value }
+func (h mockHeader) Keys() []string {
+	keys := make([]string, 0, len(h))
+	for k := range h {
+		keys = append(keys, k)
+	}
+	return keys
+}
+func (h mockHeader) Values(key string) []string {
+	if v, ok := h[key]; ok {
+		return []string{v}
+	}
+	return nil
+}
+
+type mockTransport struct {
+	header transport.Header
+}
+
+func (tr *mockTransport) Kind() transport.Kind            { return transport.KindGRPC }
+func (tr *mockTransport) Endpoint() string                { return "" }
+func (tr *mockTransport) Operation() string               { return "" }
+func (tr *mockTransport) RequestHeader() transport.Header { return tr.header }
+func (tr *mockTransport) ReplyHeader() transport.Header   { return tr.header }
+
+func TestGetCLIVersionFromHeader(t *testing.T) {
+	t.Run("returns the header value when present", func(t *testing.T) {
+		ctx := transport.NewServerContext(context.Background(), &mockTransport{
+			header: mockHeader{grpcconn.CLIVersionHeader: "v1.94.2-oss"},
+		})
+		assert.Equal(t, "v1.94.2-oss", GetCLIVersionFromHeader(ctx))
+	})
+
+	t.Run("returns empty when header is absent", func(t *testing.T) {
+		ctx := transport.NewServerContext(context.Background(), &mockTransport{header: mockHeader{}})
+		assert.Equal(t, "", GetCLIVersionFromHeader(ctx))
+	})
+
+	t.Run("returns empty when there is no transport in context", func(t *testing.T) {
+		assert.Equal(t, "", GetCLIVersionFromHeader(context.Background()))
+	})
+}
diff --git a/app/controlplane/pkg/biz/workflowcontract.go b/app/controlplane/pkg/biz/workflowcontract.go
diff --git a/app/controlplane/pkg/policies/policyprovider.go b/app/controlplane/pkg/policies/policyprovider.go
diff --git a/app/controlplane/pkg/policies/policyprovider_http_test.go b/app/controlplane/pkg/policies/policyprovider_http_test.go
diff --git a/pkg/grpcconn/grpcconn.go b/pkg/grpcconn/grpcconn.go
diff --git a/pkg/grpcconn/grpcconn_test.go b/pkg/grpcconn/grpcconn_test.go

Original file line number	Diff line number	Diff line change
`@@ -53,6 +53,7 @@ func wrappedArtifactConn(cpConn *grpc.ClientConn, role pb.CASCredentialsServiceG`
`53`	`53`
`54`	`54`	`var opts = []grpcconn.Option{`
`55`	`55`	`grpcconn.WithInsecure(apiInsecure()),`
	`56`	`+ grpcconn.WithCLIVersion(fullVersion()),`
`56`	`57`	`}`
`57`	`58`
`58`	`59`	`if caValue := viper.GetString(confOptions.CASCA.viperKey); caValue != "" {`
Original file line number	Diff line number	Diff line change
`@@ -134,6 +134,7 @@ func NewRootCmd(l zerolog.Logger) *cobra.Command {`
`134`	`134`
`135`	`135`	`var opts = []grpcconn.Option{`
`136`	`136`	`grpcconn.WithInsecure(apiInsecure()),`
	`137`	`+ grpcconn.WithCLIVersion(fullVersion()),`
`137`	`138`	`}`
`138`	`139`
`139`	`140`	`if caValue := viper.GetString(confOptions.controlplaneCA.viperKey); caValue != "" {`
`@@ -369,7 +370,7 @@ func initConfigFile() {`
`369`	`370`	`}`
`370`	`371`
`371`	`372`	`func newActionOpts(logger zerolog.Logger, conn grpc.ClientConn, token string) action.ActionsOpts {`
`372`		`- return &action.ActionsOpts{CPConnection: conn, Logger: logger, AuthTokenRaw: token, OutputFormat: flagOutputFormat}`
	`373`	`+ return &action.ActionsOpts{CPConnection: conn, Logger: logger, AuthTokenRaw: token, OutputFormat: flagOutputFormat, CLIVersion: fullVersion()}`
`373`	`374`	`}`
`374`	`375`
`375`	`376`	`func cleanup(conn *grpc.ClientConn) error {`
Original file line number	Diff line number	Diff line change
`@@ -104,7 +104,7 @@ func (action *AttestationAdd) Run(ctx context.Context, attestationID, materialNa`
`104`	`104`	`if !crafter.CraftingState.GetDryRun() {`
`105`	`105`	`client := pb.NewAttestationServiceClient(action.CPConnection)`
`106`	`106`	`workflowRunID := crafter.CraftingState.GetAttestation().GetWorkflow().GetWorkflowRunId()`
`107`		`- _, connectionCloserFn, getCASBackendErr := getCASBackend(ctx, client, workflowRunID, action.casCAPath, action.casURI, action.connectionInsecure, action.Logger, casBackend)`
	`107`	`+ _, connectionCloserFn, getCASBackendErr := getCASBackend(ctx, client, workflowRunID, action.casCAPath, action.casURI, action.connectionInsecure, action.Logger, casBackend, action.CLIVersion)`
`108`	`108`	`if getCASBackendErr != nil {`
`109`	`109`	`return nil, fmt.Errorf("failed to get CAS backend: %w", getCASBackendErr)`
`110`	`110`	`}`
Original file line number	Diff line number	Diff line change
`@@ -492,7 +492,7 @@ func (s AttestationService) GetPolicy(ctx context.Context, req cpAPI.Attestati`
`492`	`492`	`return nil, errors.Forbidden("forbidden", "organization not found")`
`493`	`493`	`}`
`494`	`494`
`495`		`- remotePolicy, err := s.workflowContractUseCase.GetPolicy(req.GetProvider(), req.GetPolicyName(), req.GetOrgName(), org.Name, token.Token)`
	`495`	`+ remotePolicy, err := s.workflowContractUseCase.GetPolicy(ctx, req.GetProvider(), req.GetPolicyName(), req.GetOrgName(), org.Name, token.Token)`
`496`	`496`	`if err != nil {`
`497`	`497`	`return nil, handleUseCaseErr(err, s.log)`
`498`	`498`	`}`
`@@ -514,7 +514,7 @@ func (s AttestationService) GetPolicyGroup(ctx context.Context, req cpAPI.Atte`
`514`	`514`	`return nil, errors.Forbidden("forbidden", "organization not found")`
`515`	`515`	`}`
`516`	`516`
`517`		`- remoteGroup, err := s.workflowContractUseCase.GetPolicyGroup(req.GetProvider(), req.GetGroupName(), req.GetOrgName(), org.Name, token.Token)`
	`517`	`+ remoteGroup, err := s.workflowContractUseCase.GetPolicyGroup(ctx, req.GetProvider(), req.GetGroupName(), req.GetOrgName(), org.Name, token.Token)`
`518`	`518`	`if err != nil {`
`519`	`519`	`return nil, handleUseCaseErr(err, s.log)`
`520`	`520`	`}`
`@@ -732,7 +732,7 @@ func (s AttestationService) FindOrCreateWorkflow(ctx context.Context, req cpAP`
`732`	`732`
`733`	`733`	`// contract validation`
`734`	`734`	`if req.GetContractBytes() != nil {`
`735`		`- if err = s.workflowContractUseCase.ValidateContractPolicies(req.GetContractBytes(), token); err != nil {`
	`735`	`+ if err = s.workflowContractUseCase.ValidateContractPolicies(ctx, req.GetContractBytes(), token); err != nil {`
`736`	`736`	`return nil, handleUseCaseErr(err, s.log)`
`737`	`737`	`}`
`738`	`738`	`}`
Original file line number	Diff line number	Diff line change
`@@ -146,7 +146,7 @@ func (s WorkflowContractService) Create(ctx context.Context, req pb.WorkflowCo`
`146`	`146`	`}`
`147`	`147`
`148`	`148`	`if len(req.RawContract) != 0 {`
`149`		`- if err = s.contractUseCase.ValidateContractPolicies(req.RawContract, token); err != nil {`
	`149`	`+ if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawContract, token); err != nil {`
`150`	`150`	`return nil, handleUseCaseErr(err, s.log)`
`151`	`151`	`}`
`152`	`152`	`}`
`@@ -212,7 +212,7 @@ func (s WorkflowContractService) Update(ctx context.Context, req pb.WorkflowCo`
`212`	`212`
`213`	`213`	`// Validate the contract policies if the raw contract is provided`
`214`	`214`	`if len(req.RawContract) != 0 {`
`215`		`- if err = s.contractUseCase.ValidateContractPolicies(req.RawContract, token); err != nil {`
	`215`	`+ if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawContract, token); err != nil {`
`216`	`216`	`return nil, handleUseCaseErr(err, s.log)`
`217`	`217`	`}`
`218`	`218`	`}`
`@@ -251,7 +251,7 @@ func (s WorkflowContractService) Apply(ctx context.Context, req pb.WorkflowCon`
`251`	`251`	`return nil, err`
`252`	`252`	`}`
`253`	`253`
`254`		`- if err = s.contractUseCase.ValidateContractPolicies(req.RawSchema, token); err != nil {`
	`254`	`+ if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawSchema, token); err != nil {`
`255`	`255`	`return nil, handleUseCaseErr(err, s.log)`
`256`	`256`	`}`
`257`	`257`