fix(cli): show policy evaluations in push output

The status call in push was skipping policy evaluation (to avoid
duplicate work), but this also skipped reading existing evaluations
from the crafting state.

Move GetPolicyEvaluations outside the skip block so status always
reads existing evaluations, and populate the status result in push
after the actual policy evaluation completes.

Fixes #2761

Signed-off-by: Miguel Martinez <miguel@chainloop.dev>

Author: migmartri

app/cli/pkg/action/attestation_add.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -178,7 +178,7 @@ func (action *AttestationAdd) GetPolicyEvaluations(ctx context.Context, attestat
 		return nil, err
 	}
 
-	policyEvaluations, _ := getPolicyEvaluations(crafter)
+	policyEvaluations, _ := GetPolicyEvaluations(crafter)
 
 	return policyEvaluations, nil
 }

app/cli/pkg/action/attestation_push.go

@@ -200,6 +200,9 @@ func (action *AttestationPush) Run(ctx context.Context, attestationID string, ru
 		return nil, fmt.Errorf("evaluating attestation policies: %w", err)
 	}
 
+	// Update the status result with the evaluated policies
+	attestationStatus.PolicyEvaluations, attestationStatus.HasPolicyViolations = GetPolicyEvaluations(crafter)
+
 	// render final attestation with all the evaluated policies inside
 	envelope, bundle, err := renderer.Render(ctx)
 	if err != nil {

app/cli/pkg/action/attestation_status.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -159,10 +159,12 @@ func (action *AttestationStatus) Run(ctx context.Context, attestationID string,
 		if err := c.EvaluateAttestationPolicies(ctx, attestationID, statement); err != nil {
 			return nil, fmt.Errorf("evaluating attestation policies: %w", err)
 		}
-
-		res.PolicyEvaluations, res.HasPolicyViolations = getPolicyEvaluations(c)
 	}
 
+	// Always read existing policy evaluations from crafting state,
+	// even when skipping re-evaluation (e.g. material-level evaluations from add)
+	res.PolicyEvaluations, res.HasPolicyViolations = GetPolicyEvaluations(c)
+
 	if v := workflowMeta.GetVersion(); v != nil {
 		res.WorkflowMeta.ProjectVersion = &ProjectVersion{
 			Version:        v.GetVersion(),
@@ -210,8 +212,9 @@ func (action *AttestationStatus) Run(ctx context.Context, attestationID string,
 	return res, nil
 }
 
-// getPolicyEvaluations retrieves both material-level and attestation-level policy evaluations and returns if it has violations
-func getPolicyEvaluations(c *crafter.Crafter) (map[string][]*PolicyEvaluation, bool) {
+// GetPolicyEvaluations retrieves both material-level and attestation-level policy evaluations from the crafting state
+// and returns whether any violations exist.
+func GetPolicyEvaluations(c *crafter.Crafter) (map[string][]*PolicyEvaluation, bool) {
 	// grouped by material name
 	evaluations := make(map[string][]*PolicyEvaluation)
 	var hasViolations bool