add skill

Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Author: jiparis

.claude/skills/custom-builtin-functions/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: custom-builtin-functions
+description: Create a custom builtin function to be used in the Rego policy engine
+---
+
+### Policy Engine Extension
+
+The OPA/Rego policy engine supports custom built-in functions written in Go.
+
+**Adding Custom Built-ins**:
+
+1. **Create Built-in Implementation** (e.g., `pkg/policies/engine/rego/builtins/myfeature.go`):
+```go
+package builtins
+
+import (
+    "github.com/open-policy-agent/opa/ast"
+    "github.com/open-policy-agent/opa/topdown"
+    "github.com/open-policy-agent/opa/types"
+)
+
+const myFuncName = "chainloop.my_function"
+
+func RegisterMyBuiltins() error {
+    return Register(&ast.Builtin{
+        Name: myFuncName,
+        Description: "Description of what this function does",
+        Decl: types.NewFunction(
+            types.Args(types.Named("input", types.S).Description("this is the input")),
+            types.Named("result", types.S).Description("this is the result"),
+        ),
+    }, myFunctionImpl)
+}
+
+func myFunctionImpl(bctx topdown.BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+    // Extract arguments
+    input, ok := operands[0].Value.(ast.String)
+    if !ok {
+        return fmt.Errorf("input must be a string")
+    }
+
+    // Implement logic
+    result := processInput(string(input))
+
+    // Return result
+    return iter(ast.StringTerm(result))
+}
+
+// Autoregisters on package load
+func init() {
+    if err := RegisterMyBuiltins(); err != nil {
+        panic(fmt.Sprintf("failed to register built-ins: %v", err))
+    }
+}
+```
+
+2. **Use in Policies** (`*.rego`):
+```rego
+package example
+import rego.v1
+
+result := {
+    "violations": violations,
+    "skipped": false
+}
+
+violations contains msg if {
+    output := chainloop.my_function(input.value)
+    output != "expected"
+    msg := "Function returned unexpected value"
+}
+```
+
+**Guidelines**:
+- Use `chainloop.*` namespace for all custom built-ins
+- Functions that call third party services should be marked as non-restrictive by adding the `NonRestrictiveBuiltin` category to the builtin definition
+- Always implement proper error handling and return meaningful error messages
+- Use context from `BuiltinContext` for timeout/cancellation support
+- Document function signatures and behavior in the `Description` field and parameter definitions

CLAUDE.md

@@ -246,91 +246,6 @@ Workflow Contracts define the structure and requirements for CI/CD attestations.
 - **Authentication**: JWT tokens generated by Control Plane, validated by CAS
 - **Streaming**: Uses gRPC bytestream protocol for efficient file transfers
 
-### Policy Engine Extension
-
-The OPA/Rego policy engine supports custom built-in functions written in Go.
-
-**Architecture** (`pkg/policies/engine/rego/builtins/`):
-- **Registry**: Manages custom built-in function registration
-- **Security Levels**: Functions tagged as `SecurityLevelRestrictive` (production-safe) or `SecurityLevelPermissive` (development-only)
-- **Operating Modes**: Restrictive mode (server-side) only allows restrictive functions; Permissive mode (CLI local dev) allows all functions
-
-**Adding Custom Built-ins**:
-
-1. **Create Built-in Implementation** (e.g., `pkg/policies/engine/rego/builtins/myfeature.go`):
-```go
-package builtins
-
-import (
-    "github.com/open-policy-agent/opa/ast"
-    "github.com/open-policy-agent/opa/topdown"
-    "github.com/open-policy-agent/opa/types"
-)
-
-const myFuncName = "chainloop.my_function"
-
-func RegisterMyBuiltins() error {
-    return Register(&BuiltinDef{
-        Name: myFuncName,
-        Decl: &ast.Builtin{
-            Name: myFuncName,
-            Decl: types.NewFunction(
-                types.Args(types.Named("input", types.S)),
-                types.Named("result", types.S),
-            ),
-        },
-        Impl:          myFunctionImpl,
-        SecurityLevel: SecurityLevelRestrictive, // or SecurityLevelPermissive
-        Description:   "Description of what this function does",
-    })
-}
-
-func myFunctionImpl(bctx topdown.BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
-    // Extract arguments
-    input, ok := operands[0].Value.(ast.String)
-    if !ok {
-        return fmt.Errorf("input must be a string")
-    }
-
-    // Implement logic
-    result := processInput(string(input))
-
-    // Return result
-    return iter(ast.StringTerm(result))
-}
-
-func init() {
-    if err := RegisterMyBuiltins(); err != nil {
-        panic(fmt.Sprintf("failed to register built-ins: %v", err))
-    }
-}
-```
-
-2. **Use in Policies** (`*.rego`):
-```rego
-package example
-import rego.v1
-
-result := {
-    "violations": violations,
-    "skipped": false
-}
-
-violations contains msg if {
-    output := chainloop.my_function(input.value)
-    output != "expected"
-    msg := "Function returned unexpected value"
-}
-```
-
-**Guidelines**:
-- Use `chainloop.*` namespace for all custom built-ins
-- Restrictive functions must be read-only, deterministic, and not make external calls
-- Permissive functions can call external services
-- Always implement proper error handling and return meaningful error messages
-- Use context from `BuiltinContext` for timeout/cancellation support
-- Document function signatures and behavior in the `Description` field
-
 ## Commit Guidelines
 
 All commits must meet these criteria:

pkg/policies/engine/rego/builtins/registry.go

@@ -19,9 +19,6 @@ import (
 	"github.com/open-policy-agent/opa/v1/topdown"
 )
 
-// SecurityLevel defines when a built-in function is allowed to execute
-type SecurityLevel int
-
 const (
 	// NonRestrictiveBuiltin is used in builtin definition categories to mark a builtin as non-suitable for Chainloop's restrictive mode
 	NonRestrictiveBuiltin = "non-restrictive"