tackle feedback and feature parity

Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Author: javirln

app/cli/cmd/root.go

@@ -34,7 +34,7 @@ import (
 	"github.com/chainloop-dev/chainloop/app/cli/pkg/plugins"
 	v1 "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
 	"github.com/chainloop-dev/chainloop/pkg/grpcconn"
-	"github.com/chainloop-dev/chainloop/pkg/policies/engine/rego/builtins"
+	"github.com/chainloop-dev/chainloop/pkg/policies/engine/builtins"
 	"github.com/rs/zerolog"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"

app/cli/internal/policydevel/lint.go

@@ -161,29 +161,19 @@ func (p *PolicyToLint) loadReferencedPolicyFiles(baseDir string) error {
 func (p *PolicyToLint) processFile(filePath string) error {
 	ext := strings.ToLower(filepath.Ext(filePath))
 
-	// WASM files: validate magic bytes
-	if ext == ".wasm" {
-		content, err := os.ReadFile(filePath)
-		if err != nil {
-			return fmt.Errorf("failed to read WASM file %s: %w", filePath, err)
-		}
-
-		// Verify magic bytes
-		if engine.DetectPolicyType(content) != engine.PolicyTypeWASM {
-			return fmt.Errorf("file has .wasm extension but is not a valid WASM file")
-		}
-
-		p.WASMFiles = append(p.WASMFiles, &File{Path: filePath, Content: content})
-		return nil
-	}
-
-	// Other files: read full content
+	// Read file content once
 	content, err := os.ReadFile(filePath)
 	if err != nil {
 		return err
 	}
 
 	switch ext {
+	case ".wasm":
+		// Verify magic bytes
+		if engine.DetectPolicyType(content) != engine.PolicyTypeWASM {
+			return fmt.Errorf("file has .wasm extension but is not a valid WASM file")
+		}
+		p.WASMFiles = append(p.WASMFiles, &File{Path: filePath, Content: content})
 	case ".yaml", ".yml":
 		p.YAMLFiles = append(p.YAMLFiles, &File{
 			Path:    filePath,

pkg/policies/engine/builtins/discover.go

@@ -0,0 +1,46 @@
+//
+// Copyright 2025 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package builtins
+
+import (
+	"context"
+
+	v1 "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
+	"google.golang.org/grpc"
+)
+
+// DiscoverService wraps the gRPC discover functionality to be shared across engines
+type DiscoverService struct {
+	conn *grpc.ClientConn
+}
+
+// NewDiscoverService creates a new discover service
+func NewDiscoverService(conn *grpc.ClientConn) *DiscoverService {
+	return &DiscoverService{conn: conn}
+}
+
+// Discover calls the DiscoverPrivate gRPC endpoint to get artifact graph data
+func (s *DiscoverService) Discover(ctx context.Context, digest, kind string) (*v1.ReferrerServiceDiscoverPrivateResponse, error) {
+	if s.conn == nil {
+		return nil, nil
+	}
+
+	client := v1.NewReferrerServiceClient(s.conn)
+	return client.DiscoverPrivate(ctx, &v1.ReferrerServiceDiscoverPrivateRequest{
+		Digest: digest,
+		Kind:   kind,
+	})
+}

pkg/policies/engine/builtins/rego.go

@@ -0,0 +1,105 @@
+//
+// Copyright 2025 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package builtins
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/open-policy-agent/opa/v1/ast"
+	"github.com/open-policy-agent/opa/v1/topdown"
+	"github.com/open-policy-agent/opa/v1/types"
+	"google.golang.org/grpc"
+)
+
+const discoverBuiltinName = "chainloop.discover"
+
+// RegisterDiscoverBuiltin registers chainloop's Discover endpoint as a builtin Rego function with signature:
+//
+//	chainloop.discover(digest, kind)
+//
+// For instance, to get the references for an CONTAINER_IMAGE material, and fail if any of them is an attestation with policy violations:
+// ```
+//
+//	violations contains msg if {
+//	  digest := sprintf("sha256:%s",[input.chainloop_metadata.digest.sha256])
+//	  discovered := chainloop.discover(digest, "")
+//
+//	  some ref in discovered.references
+//	  ref.kind == "ATTESTATION"
+//	  ref.metadata.hasPolicyViolations == "true"
+//
+//	  msg:= sprintf("attestation with digest %s contains policy violations [name: %s, project: %s, org: %s]", [ref.digest, ref.metadata.name, ref.metadata.project, ref.metadata.organization])
+//	}
+//
+// ```
+func RegisterDiscoverBuiltin(conn *grpc.ClientConn) error {
+	return register(&ast.Builtin{
+		Name:        discoverBuiltinName,
+		Description: "Discovers artifact graph data by calling the Referrer chainloop service",
+		Decl: types.NewFunction(
+			types.Args(
+				types.Named("digest", types.S).Description("digest of the artifact to discover"),
+				types.Named("kind", types.S).Description("optional filter by kind to disambiguate"),
+			),
+			types.Named("response", types.A).Description("response object as in the `chainloop discover` CLI output"),
+		),
+		Nondeterministic: true,
+	}, getDiscoverRegoImpl(conn))
+}
+
+func getDiscoverRegoImpl(conn *grpc.ClientConn) topdown.BuiltinFunc {
+	discoverSvc := NewDiscoverService(conn)
+
+	return func(bctx topdown.BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+		if len(operands) < 1 {
+			return errors.New("need at least one operand")
+		}
+
+		var digest, kind ast.String
+		var ok bool
+
+		// Extract digest
+		digest, ok = operands[0].Value.(ast.String)
+		if !ok {
+			return errors.New("digest must be a string")
+		}
+
+		if len(operands) > 1 {
+			// Extract kind
+			kind, ok = operands[1].Value.(ast.String)
+			if !ok {
+				return errors.New("kind must be a string")
+			}
+		}
+
+		// Call the shared service
+		resp, err := discoverSvc.Discover(bctx.Context, string(digest), string(kind))
+		if err != nil {
+			return fmt.Errorf("failed to call discover endpoint: %w", err)
+		}
+
+		// call the iterator with the output value
+		return iter(ast.NewTerm(ast.MustInterfaceToValue(resp.Result)))
+	}
+}
+
+// register is a wrapper around topdown.RegisterBuiltinFunc to handle registration
+func register(builtin *ast.Builtin, impl topdown.BuiltinFunc) error {
+	topdown.RegisterBuiltinFunc(builtin.Name, impl)
+	ast.RegisterBuiltin(builtin)
+	return nil
+}

pkg/policies/engine/builtins/wasm.go

@@ -0,0 +1,81 @@
+//
+// Copyright 2025 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package builtins
+
+import (
+	"context"
+	"encoding/json"
+
+	extism "github.com/extism/go-sdk"
+	"google.golang.org/grpc"
+)
+
+// CreateDiscoverHostFunction creates an Extism host function for the discover builtin
+// This allows WASM policies to call chainloop_discover(digest, kind) and get artifact graph data
+func CreateDiscoverHostFunction(conn *grpc.ClientConn) extism.HostFunction {
+	discoverSvc := NewDiscoverService(conn)
+
+	return extism.NewHostFunctionWithStack(
+		"chainloop_discover",
+		func(ctx context.Context, plugin *extism.CurrentPlugin, stack []uint64) {
+			// Read digest from WASM memory
+			digestOffset := stack[0]
+			digest, err := plugin.ReadString(digestOffset)
+			if err != nil {
+				// Return 0 to signal error
+				stack[0] = 0
+				return
+			}
+
+			// Read kind from WASM memory (if provided)
+			var kind string
+			if len(stack) > 1 && stack[1] != 0 {
+				kindOffset := stack[1]
+				kind, _ = plugin.ReadString(kindOffset)
+			}
+
+			// Call shared discover service
+			resp, err := discoverSvc.Discover(ctx, digest, kind)
+			if err != nil {
+				// Return 0 to signal error
+				stack[0] = 0
+				return
+			}
+
+			// Serialize response to JSON
+			jsonData, err := json.Marshal(resp.Result)
+			if err != nil {
+				// Return 0 to signal error
+				stack[0] = 0
+				return
+			}
+
+			// Write JSON to WASM memory and return offset
+			offset, err := plugin.WriteBytes(jsonData)
+			if err != nil {
+				// Return 0 to signal error
+				stack[0] = 0
+				return
+			}
+
+			stack[0] = offset
+		},
+		// inputs: digest offset, kind offset
+		[]extism.ValueType{extism.ValueTypeI64, extism.ValueTypeI64},
+		// output: json result offset or 0 on error
+		[]extism.ValueType{extism.ValueTypeI64},
+	)
+}