feat(controlplane): filter referrer discovery by project name and version

Add optional project_name and project_version filters to the private referrer
discovery endpoint (DiscoverPrivate). When both are provided, the discovered
referrer and its references are confined to the matching project version,
resolved by entering from the project version's workflow runs so the lookup
stays bounded regardless of how widely a material is shared.

Mark the deprecated public shared discovery endpoint as deprecated in the proto.

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Chainloop-Trace-Sessions: 593298f0-05bd-408b-9767-5472afe1caec

Author: migmartri

app/cli/pkg/action/referrer_discover.go

@@ -67,6 +67,9 @@ func NewReferrerDiscoverPublicIndex(cfg *ActionsOpts) *ReferrerDiscoverPublic {
 	return &ReferrerDiscoverPublic{cfg}
 }
 
+// Run calls the deprecated public shared index RPC, kept for backwards compatibility.
+//
+//nolint:staticcheck // the RPC is deprecated but still supported
 func (action *ReferrerDiscoverPublic) Run(ctx context.Context, digest, kind string, p *PaginationOpts) (*ReferrerDiscoverResult, error) {
 	client := pb.NewReferrerServiceClient(action.cfg.CPConnection)
 	resp, err := client.DiscoverPublicShared(ctx, &pb.DiscoverPublicSharedRequest{

app/controlplane/api/controlplane/v1/referrer.pb.go

@@ -36,7 +36,9 @@ service ReferrerService {
     };
   }
   // DiscoverPublicShared returns the referrer item for a given digest in the public shared index
+  // Deprecated: the public shared index is being retired.
   rpc DiscoverPublicShared(DiscoverPublicSharedRequest) returns (DiscoverPublicSharedResponse) {
+    option deprecated = true;
     option (google.api.http) = {get: "/discover/shared/{digest}"};
     option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
       summary: "Discover public shared referrer"
@@ -60,6 +62,21 @@ message ReferrerServiceDiscoverPrivateRequest {
   string kind = 2;
   // Pagination options for the references list
   CursorPaginationRequest pagination = 3;
+  // ProjectName optionally scopes the discovery to a project by name.
+  // Must be set together with project_version.
+  string project_name = 4;
+  // ProjectVersion optionally scopes the discovery to a project version (by name, e.g. v1.2.0).
+  // The referrer and its references are confined to this project version.
+  // Must be set together with project_name.
+  string project_version = 5;
+
+  // project_name and project_version must be provided together: a version name is unique only
+  // within a project, and a project name on its own would not scope the discovery.
+  option (buf.validate.message).cel = {
+    id: "discover_project_version_dependency"
+    expression: "(this.project_name == '') == (this.project_version == '')"
+    message: "project_name and project_version must be set together"
+  };
 
   option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_schema) = {
     json_schema: {
@@ -70,7 +87,10 @@ message ReferrerServiceDiscoverPrivateRequest {
 }
 
 // DiscoverPublicSharedRequest is the request for the DiscoverPublicShared method
+// Deprecated: the public shared index is being retired.
 message DiscoverPublicSharedRequest {
+  option deprecated = true;
+
   // Digest is the unique identifier of the referrer to discover
   string digest = 1 [(buf.validate.field).string = {min_len: 1}];
   // Kind is the optional type of referrer, i.e CONTAINER_IMAGE, GIT_HEAD, ...