chore(gates): store whether the attestation was gated (#2660)

jiparis · web-flow · commit 3237c26caecb · 2026-01-13T17:58:45.000+01:00
Signed-off-by: Jose I. Paris &lt;jiparis@chainloop.dev&gt;
diff --git a/app/cli/cmd/workflow_workflow_run_describe.go b/app/cli/cmd/workflow_workflow_run_describe.go
@@ -165,6 +165,9 @@ func workflowRunDescribeTableOutput(run *action.WorkflowRunItemFull) error {
 	if att.PolicyEvaluationStatus.Blocked {
 		gt.AppendRow(table.Row{"Run Blocked", att.PolicyEvaluationStatus.Blocked})
 	}
+	if att.PolicyEvaluationStatus.HasGatedViolations {
+		gt.AppendRow(table.Row{"Run Gated", text.Colors{text.FgHiRed}.Sprint(att.PolicyEvaluationStatus.HasGatedViolations)})
+	}
 	if att.PolicyEvaluationStatus.Strategy == action.PolicyViolationBlockingStrategyEnforced {
 		gt.AppendRow(table.Row{"Policy enforcement bypassed", att.PolicyEvaluationStatus.Bypassed})
 	}
diff --git a/app/cli/pkg/action/workflow_run_describe.go b/app/cli/pkg/action/workflow_run_describe.go
@@ -64,10 +64,11 @@ type WorkflowRunAttestationItem struct {
 }
 
 type PolicyEvaluationStatus struct {
-	Strategy      string `json:"strategy"`
-	Bypassed      bool   `json:"bypassed"`
-	Blocked       bool   `json:"blocked"`
-	HasViolations bool   `json:"has_violations"`
+	Strategy           string `json:"strategy"`
+	Bypassed           bool   `json:"bypassed"`
+	Blocked            bool   `json:"blocked"`
+	HasViolations      bool   `json:"has_violations"`
+	HasGatedViolations bool   `json:"has_gated_violations"`
 }
 
 type Material struct {
@@ -236,10 +237,11 @@ func (action *WorkflowRunDescribe) Run(ctx context.Context, opts *WorkflowRunDes
 		Digest:            att.DigestInCasBackend,
 		PolicyEvaluations: evaluations,
 		PolicyEvaluationStatus: &PolicyEvaluationStatus{
-			Strategy:      policyEvaluationStatus.Strategy,
-			Bypassed:      policyEvaluationStatus.Bypassed,
-			Blocked:       policyEvaluationStatus.Blocked,
-			HasViolations: policyEvaluationStatus.HasViolations,
+			Strategy:           policyEvaluationStatus.Strategy,
+			Bypassed:           policyEvaluationStatus.Bypassed,
+			Blocked:            policyEvaluationStatus.Blocked,
+			HasViolations:      policyEvaluationStatus.HasViolations,
+			HasGatedViolations: policyEvaluationStatus.HasGatedViolations,
 		},
 	}
 
diff --git a/app/controlplane/api/controlplane/v1/response_messages.pb.go b/app/controlplane/api/controlplane/v1/response_messages.pb.go
diff --git a/app/controlplane/api/controlplane/v1/response_messages.proto b/app/controlplane/api/controlplane/v1/response_messages.proto
@@ -116,6 +116,7 @@ message AttestationItem {
     bool bypassed = 2;
     bool blocked = 3;
     bool has_violations = 4;
+    bool has_gated_violations = 5;
   }
 
   message EnvVariable {
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/response_messages.ts b/app/controlplane/api/gen/frontend/controlplane/v1/response_messages.ts
diff --git a/app/controlplane/api/gen/jsonschema/controlplane.v1.AttestationItem.PolicyEvaluationStatus.jsonschema.json b/app/controlplane/api/gen/jsonschema/controlplane.v1.AttestationItem.PolicyEvaluationStatus.jsonschema.json
diff --git a/app/controlplane/api/gen/jsonschema/controlplane.v1.AttestationItem.PolicyEvaluationStatus.schema.json b/app/controlplane/api/gen/jsonschema/controlplane.v1.AttestationItem.PolicyEvaluationStatus.schema.json
diff --git a/app/controlplane/internal/service/attestation.go b/app/controlplane/internal/service/attestation.go
@@ -553,10 +553,11 @@ func bizAttestationToPb(att *biz.Attestation) (*cpAPI.AttestationItem, error) {
 		Annotations:        predicate.GetAnnotations(),
 		PolicyEvaluations:  extractPolicyEvaluations(predicate.GetPolicyEvaluations()),
 		PolicyEvaluationStatus: &cpAPI.AttestationItem_PolicyEvaluationStatus{
-			Strategy:      string(policyEvaluationStatus.Strategy),
-			Bypassed:      policyEvaluationStatus.Bypassed,
-			Blocked:       policyEvaluationStatus.Blocked,
-			HasViolations: policyEvaluationStatus.HasViolations,
+			Strategy:           string(policyEvaluationStatus.Strategy),
+			Bypassed:           policyEvaluationStatus.Bypassed,
+			Blocked:            policyEvaluationStatus.Blocked,
+			HasViolations:      policyEvaluationStatus.HasViolations,
+			HasGatedViolations: policyEvaluationStatus.HasGatedViolations,
 		},
 		Bundle: att.Bundle,
 	}, nil
diff --git a/app/controlplane/pkg/biz/referrer.go b/app/controlplane/pkg/biz/referrer.go
@@ -300,12 +300,14 @@ func extractReferrers(att *dsse.Envelope, digest cr_v1.Hash, repo ReferrerRepo)
 	// We add both annotations and workflow metadata
 	attestationReferrer.Annotations = predicate.GetAnnotations()
 	hasViolations := predicate.GetPolicyEvaluationStatus().HasViolations
+	hasGatedViolations := predicate.GetPolicyEvaluationStatus().HasGatedViolations
 	attestationReferrer.Metadata = map[string]string{
 		// workflow name, team and project
 		"name":                     predicate.GetMetadata().Name,
 		"team":                     predicate.GetMetadata().Team,
 		"project":                  predicate.GetMetadata().Project,
 		"hasPolicyViolations":      fmt.Sprintf("%t", hasViolations),
+		"hasGatedPolicyViolations": fmt.Sprintf("%t", hasGatedViolations),
 		"projectVersion":           predicate.GetMetadata().ProjectVersion,
 		"projectVersionPrerelease": fmt.Sprintf("%t", predicate.GetMetadata().ProjectVersionPrerelease),
 		"organization":             predicate.GetMetadata().Organization,
diff --git a/app/controlplane/pkg/biz/referrer_integration_test.go b/app/controlplane/pkg/biz/referrer_integration_test.go
@@ -257,6 +257,7 @@ func (s *referrerIntegrationTestSuite) TestExtractAndPersists() {
 			"project":                  "test",
 			"team":                     "my-team",
 			"organization":             "my-org",
+			"hasGatedPolicyViolations": "false",
 			"hasPolicyViolations":      "false",
 			"projectVersion":           "",
 			"projectVersionPrerelease": "false",
diff --git a/app/controlplane/pkg/biz/referrer_test.go b/app/controlplane/pkg/biz/referrer_test.go
@@ -103,6 +103,7 @@ func (s *referrerTestSuite) TestExtractReferrers() {
 						"project":                  "foo",
 						"projectVersion":           "",
 						"projectVersionPrerelease": "false",
+						"hasGatedPolicyViolations": "false",
 						"hasPolicyViolations":      "false",
 					},
 					Annotations: map[string]string{
@@ -157,6 +158,7 @@ func (s *referrerTestSuite) TestExtractReferrers() {
 						"project":                  "bar",
 						"projectVersion":           "",
 						"projectVersionPrerelease": "false",
+						"hasGatedPolicyViolations": "false",
 						"hasPolicyViolations":      "false",
 					},
 					Annotations: map[string]string{
@@ -193,6 +195,7 @@ func (s *referrerTestSuite) TestExtractReferrers() {
 						"project":                  "foo",
 						"projectVersion":           "",
 						"projectVersionPrerelease": "false",
+						"hasGatedPolicyViolations": "false",
 						"hasPolicyViolations":      "false",
 					},
 					Annotations: map[string]string{
@@ -257,6 +260,7 @@ func (s *referrerTestSuite) TestExtractReferrers() {
 						"project":                  "test",
 						"projectVersion":           "",
 						"projectVersionPrerelease": "false",
+						"hasGatedPolicyViolations": "false",
 						"hasPolicyViolations":      "false",
 					},
 					References: []*Referrer{
diff --git a/pkg/attestation/renderer/chainloop/chainloop.go b/pkg/attestation/renderer/chainloop/chainloop.go
@@ -54,6 +54,8 @@ type PolicyEvaluationStatus struct {
 	Blocked bool
 	// Whether the attestation has policy violations
 	HasViolations bool
+	// Whether the attestation has gated policy violations
+	HasGatedViolations bool
 }
 
 type NormalizedMaterial struct {
diff --git a/pkg/attestation/renderer/chainloop/v02.go b/pkg/attestation/renderer/chainloop/v02.go
@@ -48,6 +48,8 @@ type ProvenancePredicateV02 struct {
 
 	// Whether the attestation has policy violations
 	PolicyHasViolations bool `json:"policyHasViolations"`
+	// Whether the attestation has policy violations in gated policies
+	PolicyHasGatedViolations bool `json:"policyHasGatedViolations,omitempty"`
 	// Whether we want to block the attestation on policy violations
 	PolicyCheckBlockingStrategy PolicyViolationBlockingStrategy `json:"policyCheckBlockingStrategy"`
 	// Whether the policy check was bypassed
@@ -248,6 +250,7 @@ func (r *RendererV02) predicate() (*structpb.Struct, error) {
 		Materials:                   normalizedMaterials,
 		PolicyEvaluations:           policies,
 		PolicyHasViolations:         hasViolations,
+		PolicyHasGatedViolations:    gated,
 		PolicyCheckBlockingStrategy: policyCheckBlockingStrategy,
 		PolicyBlockBypassEnabled:    r.att.GetBypassPolicyCheck(),
 		PolicyAttBlocked:            blocked,
@@ -413,10 +416,11 @@ func (p *ProvenancePredicateV02) GetPolicyEvaluations() map[string][]*PolicyEval
 
 func (p *ProvenancePredicateV02) GetPolicyEvaluationStatus() *PolicyEvaluationStatus {
 	return &PolicyEvaluationStatus{
-		Strategy:      p.PolicyCheckBlockingStrategy,
-		Bypassed:      p.PolicyBlockBypassEnabled,
-		Blocked:       p.PolicyAttBlocked,
-		HasViolations: p.PolicyHasViolations,
+		Strategy:           p.PolicyCheckBlockingStrategy,
+		Bypassed:           p.PolicyBlockBypassEnabled,
+		Blocked:            p.PolicyAttBlocked,
+		HasViolations:      p.PolicyHasViolations,
+		HasGatedViolations: p.PolicyHasGatedViolations,
 	}
 }
 

Original file line number	Diff line number	Diff line change
`@@ -165,6 +165,9 @@ func workflowRunDescribeTableOutput(run *action.WorkflowRunItemFull) error {`
`165`	`165`	`if att.PolicyEvaluationStatus.Blocked {`
`166`	`166`	`gt.AppendRow(table.Row{"Run Blocked", att.PolicyEvaluationStatus.Blocked})`
`167`	`167`	`}`
	`168`	`+ if att.PolicyEvaluationStatus.HasGatedViolations {`
	`169`	`+ gt.AppendRow(table.Row{"Run Gated", text.Colors{text.FgHiRed}.Sprint(att.PolicyEvaluationStatus.HasGatedViolations)})`
	`170`	`+ }`
`168`	`171`	`if att.PolicyEvaluationStatus.Strategy == action.PolicyViolationBlockingStrategyEnforced {`
`169`	`172`	`gt.AppendRow(table.Row{"Policy enforcement bypassed", att.PolicyEvaluationStatus.Bypassed})`
`170`	`173`	`}`
Original file line number	Diff line number	Diff line change
`@@ -116,6 +116,7 @@ message AttestationItem {`
`116`	`116`	`bool bypassed = 2;`
`117`	`117`	`bool blocked = 3;`
`118`	`118`	`bool has_violations = 4;`
	`119`	`+ bool has_gated_violations = 5;`
`119`	`120`	`}`
`120`	`121`
`121`	`122`	`message EnvVariable {`