fix(crafter): treat ENOTDIR as a non-archive in detectByMagic

A non-file material value whose first path segment is an existing
regular file (e.g. a CONTAINER_IMAGE ref like "registry/app:v1")
yields ENOTDIR on open rather than not-found. Swallow it alongside
fs.ErrNotExist so such values detect as non-archive instead of failing
detection; genuine permission/I/O errors still surface.

Assisted-by: Claude Code
Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Chainloop-Trace-Sessions: da72e107-14e9-4da1-add0-28004f542628, ef6d3cdb-5a23-445c-b39a-510b659023e4

Author: javirln

pkg/attestation/crafter/materials/archive.go

@@ -27,6 +27,7 @@ import (
 	"os"
 	"path"
 	"strings"
+	"syscall"
 
 	schemaapi "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
 )
@@ -62,11 +63,13 @@ func DetectArchive(path string) (ArchiveFormat, error) {
 func detectByMagic(path string) (ArchiveFormat, error) {
 	f, err := os.Open(path)
 	if err != nil {
-		// A not-found error means the value is not a file path at all (e.g.
-		// "hello world" for STRING or "registry/app:v1" for CONTAINER_IMAGE);
-		// treat that as a non-archive so callers passing non-file values are not
-		// surprised. Any other error (permissions, I/O) is real and must surface.
-		if errors.Is(err, fs.ErrNotExist) {
+		// These errors mean the value is not a file path at all (e.g. "hello
+		// world" for STRING, or "registry/app:v1" for CONTAINER_IMAGE where
+		// "registry" happens to be a regular file in the working directory, which
+		// yields ENOTDIR); treat them as a non-archive so callers passing non-file
+		// values are not surprised. Any other error (permissions, I/O) is real and
+		// must surface.
+		if errors.Is(err, fs.ErrNotExist) || errors.Is(err, syscall.ENOTDIR) {
 			return ArchiveNone, nil
 		}
 		return ArchiveNone, fmt.Errorf("opening %q: %w", path, err)

pkg/attestation/crafter/materials/archive_test.go

@@ -107,6 +107,11 @@ func TestDetectArchive(t *testing.T) {
 		{"tgz by extension", tgzShortPath, ArchiveTarGz},
 		{"plain file", plain, ArchiveNone},
 		{"zip without extension via magic", noExt, ArchiveZip},
+		// Non-file values must detect as non-archive without erroring.
+		{"non-existent value", filepath.Join(dir, "nope"), ArchiveNone},
+		// A value whose first path segment is an existing regular file yields
+		// ENOTDIR on open (e.g. CONTAINER_IMAGE "registry/app:v1"); still a non-archive.
+		{"path segment is a file (ENOTDIR)", filepath.Join(plain, "app:v1"), ArchiveNone},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {