feat(cli): show assessment status on active violations too, drop "[no fix]"

Assessment statuses other than NOT_AFFECTED/FIXED (AFFECTED,
UNDER_INVESTIGATION, etc.) are equally meaningful on findings that
remain active. Surface them in the same severity-parens regardless of
the suppress flag so active rows can read e.g.
"CVE-X (HIGH, AFFECTED) libc6@2.41" or
"CVE-X (HIGH, UNDER_INVESTIGATION) libc6@2.41".

Suppressed findings without an explicit assessment fall back to the
literal "suppressed" tag (unchanged for existing tests). Coloring
still red/yellow by suppress flag — assessment status is metadata,
gate state is independent.

Also drop "[no fix]" — the absence of "[fix: vN]" already conveys it
and shaves a column. Extracted violationAssessment helper centralizing
the Vulnerability/Sast/LicenseViolation dispatch (replaces
suppressedStatus). joinTag inlined to direct conditional.

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Chainloop-Trace-Sessions: 5bd2a917-fb7b-400c-9772-60ba6af6c9af, b66717f5-626e-4c20-8d33-59c129b5885d

Author: migmartri

app/cli/cmd/workflow_workflow_run_describe.go

@@ -27,6 +27,7 @@ import (
 
 	"github.com/chainloop-dev/chainloop/app/cli/cmd/output"
 	"github.com/chainloop-dev/chainloop/app/cli/pkg/action"
+	attv1 "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer/chainloop"
 	"github.com/jedib0t/go-pretty/v6/table"
 	"github.com/jedib0t/go-pretty/v6/text"
@@ -295,40 +296,34 @@ func policiesTable(evs []*action.PolicyEvaluation, mt table.Writer, debugMode bo
 // structured finding when present (CVE id + severity + package + fix info,
 // or SAST rule + location, or license + component). Falls back to the first
 // line of Message — vuln policies emit a multi-line markdown report there
-// which would otherwise break the row layout. Suppressed entries get the
-// resolved assessment status appended inside the same severity-parens so
-// the row reads "CVE-X (HIGH, NOT_AFFECTED) …".
+// which would otherwise break the row layout. The resolved assessment
+// status, if any, is appended inside the same severity-parens regardless
+// of suppression so AFFECTED / UNDER_INVESTIGATION / etc. surface on
+// active findings too.
 func violationSummary(v *action.PolicyViolation) string {
-	suppressTag := ""
-	if v.Suppress {
-		suppressTag = "suppressed"
-		if s := suppressedStatus(v); s != "" {
-			suppressTag = s
-		}
+	statusTag := prettyAssessmentStatus(violationAssessment(v).GetEffectiveStatus())
+	if statusTag == "" && v.Suppress {
+		statusTag = "suppressed"
 	}
 
 	switch {
 	case v.Vulnerability != nil:
 		f := v.Vulnerability
 		head := f.GetExternalId()
-		if tag := joinTag(f.GetSeverity(), suppressTag); tag != "" {
+		if tag := joinTag(f.GetSeverity(), statusTag); tag != "" {
 			head = fmt.Sprintf("%s (%s)", head, tag)
 		}
-		parts := []string{head}
 		if pkg := prettyPurl(f.GetPackagePurl()); pkg != "" {
-			parts = append(parts, pkg)
+			head += " " + pkg
 		}
-		out := strings.Join(parts, " ")
 		if fix := f.GetFixedVersion(); fix != "" {
-			out += " [fix: " + fix + "]"
-		} else {
-			out += " [no fix]"
+			head += " [fix: " + fix + "]"
 		}
-		return out
+		return head
 	case v.Sast != nil:
 		f := v.Sast
 		out := f.GetRuleId()
-		if tag := joinTag(f.GetSeverity(), suppressTag); tag != "" {
+		if tag := joinTag(f.GetSeverity(), statusTag); tag != "" {
 			out = fmt.Sprintf("%s (%s)", out, tag)
 		}
 		if loc := f.GetLocation(); loc != "" {
@@ -342,8 +337,8 @@ func violationSummary(v *action.PolicyViolation) string {
 	case v.LicenseViolation != nil:
 		f := v.LicenseViolation
 		out := f.GetLicenseId()
-		if suppressTag != "" {
-			out = fmt.Sprintf("%s (%s)", out, suppressTag)
+		if statusTag != "" {
+			out = fmt.Sprintf("%s (%s)", out, statusTag)
 		}
 		if c := f.GetComponentName(); c != "" {
 			if ver := f.GetComponentVersion(); ver != "" {
@@ -358,36 +353,38 @@ func violationSummary(v *action.PolicyViolation) string {
 	if head == "" {
 		head = v.Subject
 	}
-	if suppressTag != "" {
-		head = fmt.Sprintf("%s (%s)", head, suppressTag)
+	if statusTag != "" {
+		head = fmt.Sprintf("%s (%s)", head, statusTag)
 	}
 	return head
 }
 
-// joinTag combines severity and the suppression tag (assessment status when
-// available, "suppressed" otherwise) into the comma-separated parenthetical
-// shown after the finding id. Empty inputs are skipped.
-func joinTag(severity, suppress string) string {
-	var parts []string
-	if severity != "" {
-		parts = append(parts, strings.ToUpper(severity))
-	}
-	if suppress != "" {
-		parts = append(parts, suppress)
+// joinTag combines severity and the assessment status into the
+// comma-separated parenthetical shown after the finding id.
+func joinTag(severity, status string) string {
+	sev := strings.ToUpper(severity)
+	switch {
+	case sev != "" && status != "":
+		return sev + ", " + status
+	case sev != "":
+		return sev
+	default:
+		return status
 	}
-	return strings.Join(parts, ", ")
 }
 
-func suppressedStatus(v *action.PolicyViolation) string {
+// violationAssessment returns the assessment attached to whichever structured
+// finding the violation carries, or nil. Centralizes the type dispatch.
+func violationAssessment(v *action.PolicyViolation) *attv1.PolicyAssessmentResult {
 	switch {
 	case v.Vulnerability != nil:
-		return prettyAssessmentStatus(v.Vulnerability.GetAssessment().GetEffectiveStatus())
+		return v.Vulnerability.GetAssessment()
 	case v.Sast != nil:
-		return prettyAssessmentStatus(v.Sast.GetAssessment().GetEffectiveStatus())
+		return v.Sast.GetAssessment()
 	case v.LicenseViolation != nil:
-		return prettyAssessmentStatus(v.LicenseViolation.GetAssessment().GetEffectiveStatus())
+		return v.LicenseViolation.GetAssessment()
 	}
-	return ""
+	return nil
 }
 
 func prettyAssessmentStatus(s string) string {

app/cli/cmd/workflow_workflow_run_describe_test.go

@@ -56,15 +56,15 @@ func TestViolationSummary(t *testing.T) {
 		want      string
 	}{
 		{
-			name: "vulnerability with severity, package, no fix",
+			name: "vulnerability with severity and package, no fix",
 			violation: &action.PolicyViolation{
 				Vulnerability: &attv1.PolicyVulnerabilityFinding{
 					ExternalId:  "CVE-2026-5450",
 					Severity:    "critical",
 					PackagePurl: "pkg:deb/debian/libc6@2.41-12%2Bdeb13u2",
 				},
 			},
-			want: "CVE-2026-5450 (CRITICAL) libc6@2.41-12+deb13u2 [no fix]",
+			want: "CVE-2026-5450 (CRITICAL) libc6@2.41-12+deb13u2",
 		},
 		{
 			name: "vulnerability with fix version",
@@ -78,6 +78,34 @@ func TestViolationSummary(t *testing.T) {
 			},
 			want: "CVE-2024-9999 (HIGH) lib@v1.0.0 [fix: 1.0.1]",
 		},
+		{
+			name: "active vulnerability surfaces assessment status (AFFECTED)",
+			violation: &action.PolicyViolation{
+				Vulnerability: &attv1.PolicyVulnerabilityFinding{
+					ExternalId:  "CVE-2024-1",
+					Severity:    "high",
+					PackagePurl: "pkg:deb/debian/libc6@2.41",
+					Assessment: &attv1.PolicyAssessmentResult{
+						EffectiveStatus: "ASSESSMENT_STATUS_AFFECTED",
+					},
+				},
+			},
+			want: "CVE-2024-1 (HIGH, AFFECTED) libc6@2.41",
+		},
+		{
+			name: "active vulnerability surfaces assessment status (UNDER_INVESTIGATION)",
+			violation: &action.PolicyViolation{
+				Vulnerability: &attv1.PolicyVulnerabilityFinding{
+					ExternalId:  "CVE-2024-2",
+					Severity:    "medium",
+					PackagePurl: "pkg:deb/debian/libc6@2.41",
+					Assessment: &attv1.PolicyAssessmentResult{
+						EffectiveStatus: "ASSESSMENT_STATUS_UNDER_INVESTIGATION",
+					},
+				},
+			},
+			want: "CVE-2024-2 (MEDIUM, UNDER_INVESTIGATION) libc6@2.41",
+		},
 		{
 			name: "suppressed vulnerability gets assessment status inline",
 			violation: &action.PolicyViolation{
@@ -91,7 +119,7 @@ func TestViolationSummary(t *testing.T) {
 					},
 				},
 			},
-			want: "CVE-2018-XXXX (LOW, NOT_AFFECTED) libc6@2.41 [no fix]",
+			want: "CVE-2018-XXXX (LOW, NOT_AFFECTED) libc6@2.41",
 		},
 		{
 			name: "SAST with location and line number",
@@ -153,12 +181,12 @@ func TestViolationSummary(t *testing.T) {
 			name: "vulnerability with purl qualifiers strips them",
 			violation: &action.PolicyViolation{
 				Vulnerability: &attv1.PolicyVulnerabilityFinding{
-					ExternalId:  "CVE-2024-1",
+					ExternalId:  "CVE-2024-3",
 					Severity:    "high",
 					PackagePurl: "pkg:deb/debian/libc6@2.41?arch=amd64",
 				},
 			},
-			want: "CVE-2024-1 (HIGH) libc6@2.41 [no fix]",
+			want: "CVE-2024-3 (HIGH) libc6@2.41",
 		},
 	}