Merge branch 'main' into revisit-cas-backend-permissions

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

.claude/skills/custom-builtin-functions/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: custom-builtin-functions
+description: Create a custom builtin function to be used in the Rego policy engine
+---
+
+### Policy Engine Extension
+
+The OPA/Rego policy engine supports custom built-in functions written in Go.
+
+**Adding Custom Built-ins**:
+
+1. **Create Built-in Implementation** (e.g., `pkg/policies/engine/rego/builtins/myfeature.go`):
+```go
+package builtins
+
+import (
+    "github.com/open-policy-agent/opa/ast"
+    "github.com/open-policy-agent/opa/topdown"
+    "github.com/open-policy-agent/opa/types"
+)
+
+const myFuncName = "chainloop.my_function"
+
+func RegisterMyBuiltins() error {
+    return Register(&ast.Builtin{
+        Name: myFuncName,
+        Description: "Description of what this function does",
+        Decl: types.NewFunction(
+            types.Args(types.Named("input", types.S).Description("this is the input")),
+            types.Named("result", types.S).Description("this is the result"),
+        ),
+    }, myFunctionImpl)
+}
+
+func myFunctionImpl(bctx topdown.BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+    // Extract arguments
+    input, ok := operands[0].Value.(ast.String)
+    if !ok {
+        return fmt.Errorf("input must be a string")
+    }
+
+    // Implement logic
+    result := processInput(string(input))
+
+    // Return result
+    return iter(ast.StringTerm(result))
+}
+
+// Autoregisters on package load
+func init() {
+    if err := RegisterMyBuiltins(); err != nil {
+        panic(fmt.Sprintf("failed to register built-ins: %v", err))
+    }
+}
+```
+
+2. **Use in Policies** (`*.rego`):
+```rego
+package example
+import rego.v1
+
+result := {
+    "violations": violations,
+    "skipped": false
+}
+
+violations contains msg if {
+    output := chainloop.my_function(input.value)
+    output != "expected"
+    msg := "Function returned unexpected value"
+}
+```
+
+**Guidelines**:
+- Use `chainloop.*` namespace for all custom built-ins
+- Functions that call third party services should be marked as non-restrictive by adding the `NonRestrictiveBuiltin` category to the builtin definition
+- Always implement proper error handling and return meaningful error messages
+- Use context from `BuiltinContext` for timeout/cancellation support
+- Document function signatures and behavior in the `Description` field and parameter definitions

.github/workflows/release.yaml

@@ -25,7 +25,8 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Install Chainloop
         run: |
-          curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s
+          # Need the ee CLI to have access to project management capabilities
+          curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --ee
 
       - name: Initialize Attestation
         id: init_attestation
@@ -161,6 +162,12 @@ jobs:
           gh release download ${{ github.ref_name }} -A tar.gz -O /tmp/source-code.tar.gz
           chainloop attestation add --name source-code --value /tmp/source-code.tar.gz --kind ARTIFACT --attestation-id ${{ env.ATTESTATION_ID }}
 
+      - name: Promote Chainloop Project Version
+        run: |
+          current_version="$(cat .chainloop.yml | awk '/^projectVersion:/ {print $2}')"
+          # Rename the existing pre-release into the actual release name
+          chainloop project version update --project ${CHAINLOOP_PROJECT_NAME} --name $current_version --new-name ${{ github.ref_name }} || true
+
       - name: Bump Chart and Dagger Version
         run: .github/workflows/utils/bump-chart-and-dagger-version.sh deployment/chainloop extras/dagger ${{ github.ref_name }}
       - name: Bump Project Version

CLAUDE.md

@@ -269,4 +269,5 @@ Code reviews are required for all submissions via GitHub pull requests.
 - when creating PR message, keep it high-level, what functionality was added, don't add info about testing, no icons, no info about how the message was generated.
 - app/controlplane/api/gen/frontend/google/protobuf/descriptor.ts is a special case that we don't want to upgrade, so if it upgrades, put it back to main
 - when creating a commit or PR message, NEVER add co-authored by or generated by Claude code
-- any call to authorization Enforce done from the biz or svc layer must be done using biz.AuthzUseCase
+- any call to authorization Enforce done from the biz or svc layer must be done using biz.AuthzUseCase
+- if you modify a schema, remember to run `make migration_sync`

app/cli/cmd/workflow_workflow_run_describe.go

@@ -128,6 +128,7 @@ func workflowRunDescribeTableOutput(run *action.WorkflowRunItemFull) error {
 	if wr.Reason != "" {
 		gt.AppendRow(table.Row{"Failure Reason", wr.Reason})
 	}
+	gt.AppendRow(table.Row{"Policy Status", wr.PolicyStatus})
 	gt.AppendRow(table.Row{"Runner Link", wr.RunURL})
 
 	if run.WorkflowRun.FinishedAt == nil {

app/cli/cmd/workflow_workflow_run_list.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -33,7 +33,7 @@ func newWorkflowWorkflowRunListCmd() *cobra.Command {
 		DefaultLimit: 50,
 	}
 
-	var workflowName, projectName, status string
+	var workflowName, projectName, status, policyStatus string
 
 	cmd := &cobra.Command{
 		Use:     "list",
@@ -44,6 +44,10 @@ func newWorkflowWorkflowRunListCmd() *cobra.Command {
 				return fmt.Errorf("invalid status %q, please chose one of: %v", status, listAvailableWorkflowStatusFlag())
 			}
 
+			if policyStatus != "" && !slices.Contains([]string{"all", "failed", "passed"}, policyStatus) {
+				return fmt.Errorf("invalid policy-status %q, please chose one of: all, failed, passed", policyStatus)
+			}
+
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -55,7 +59,8 @@ func newWorkflowWorkflowRunListCmd() *cobra.Command {
 						Limit:      paginationOpts.Limit,
 						NextCursor: paginationOpts.NextCursor,
 					},
-					Status: status,
+					Status:       status,
+					PolicyStatus: policyStatus,
 				},
 			)
 			if err != nil {
@@ -85,6 +90,7 @@ func newWorkflowWorkflowRunListCmd() *cobra.Command {
 	cmd.Flags().StringVar(&projectName, "project", "", "project name")
 	cmd.Flags().BoolVar(&full, "full", false, "full report")
 	cmd.Flags().StringVar(&status, "status", "", fmt.Sprintf("filter by workflow run status: %v", listAvailableWorkflowStatusFlag()))
+	cmd.Flags().StringVar(&policyStatus, "policy-status", "", "filter by policy violations status: all, failed, passed")
 	// Add pagination flags
 	paginationOpts.AddFlags(cmd)
 
@@ -97,7 +103,7 @@ func workflowRunListTableOutput(runs []*action.WorkflowRunItem) error {
 		return nil
 	}
 
-	header := table.Row{"ID", "Workflow", "Version", "State", "Created At", "Runner"}
+	header := table.Row{"ID", "Workflow", "Version", "State", "Policy Status", "Created At", "Runner"}
 	if full {
 		header = append(header, "Finished At", "Failure reason")
 	}
@@ -107,7 +113,7 @@ func workflowRunListTableOutput(runs []*action.WorkflowRunItem) error {
 
 	for _, p := range runs {
 		wf := p.Workflow
-		r := table.Row{p.ID, wf.NamespacedName(), versionString(p.ProjectVersion), p.State, p.CreatedAt.Format(time.RFC822), p.RunnerType}
+		r := table.Row{p.ID, wf.NamespacedName(), versionString(p.ProjectVersion), p.State, p.PolicyStatus, p.CreatedAt.Format(time.RFC822), p.RunnerType}
 
 		if full {
 			var finishedAt string

app/cli/documentation/cli-reference.mdx

@@ -3890,13 +3890,14 @@ chainloop workflow workflow-run list [flags]
 Options
 
 ```
---full              full report
--h, --help              help for list
---limit int         number of items to show (default 50)
---next string       cursor to load the next page
---project string    project name
---status string     filter by workflow run status: [CANCELLED EXPIRED FAILED INITIALIZED SUCCEEDED]
---workflow string   workflow name
+--full                   full report
+-h, --help                   help for list
+--limit int              number of items to show (default 50)
+--next string            cursor to load the next page
+--policy-status string   filter by policy violations status: all, failed, passed
+--project string         project name
+--status string          filter by workflow run status: [CANCELLED EXPIRED FAILED INITIALIZED SUCCEEDED]
+--workflow string        workflow name
 ```
 
 Options inherited from parent commands

app/cli/internal/policydevel/eval.go

@@ -165,9 +165,6 @@ func verifyMaterial(pol *v1.Policies, material *v12.Attestation_Material, materi
 }
 
 func craftMaterial(materialPath, materialKind string, logger *zerolog.Logger) (*v12.Attestation_Material, error) {
-	if fileNotExists(materialPath) {
-		return nil, fmt.Errorf("%s: does not exists", materialPath)
-	}
 	backend := &casclient.CASBackend{
 		Name:     "backend",
 		MaxSize:  0,

app/cli/pkg/action/workflow_run_list.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -52,6 +52,7 @@ type WorkflowRunItem struct {
 	ContractRevisionUsed   int                          `json:"contractRevisionUsed"`
 	ContractRevisionLatest int                          `json:"contractRevisionLatest"`
 	ProjectVersion         *ProjectVersion              `json:"projectVersion,omitempty"`
+	PolicyStatus           string                       `json:"policyStatus,omitempty"`
 }
 
 type ProjectVersion struct {
@@ -74,6 +75,7 @@ type WorkflowRunListOpts struct {
 	WorkflowName, ProjectName string
 	Pagination                *PaginationOpts
 	Status                    string
+	PolicyStatus              string
 }
 type PaginationOpts struct {
 	Limit      int
@@ -95,6 +97,18 @@ func (action *WorkflowRunList) Run(opts *WorkflowRunListOpts) (*PaginatedWorkflo
 		req.Status = v
 	}
 
+	// Map policy status string to proto enum
+	if opts.PolicyStatus != "" {
+		switch opts.PolicyStatus {
+		case "failed":
+			req.PolicyViolations = pb.PolicyViolationsFilter_POLICY_VIOLATIONS_FILTER_WITH_VIOLATIONS
+		case "passed":
+			req.PolicyViolations = pb.PolicyViolationsFilter_POLICY_VIOLATIONS_FILTER_WITHOUT_VIOLATIONS
+		case "all":
+			req.PolicyViolations = pb.PolicyViolationsFilter_POLICY_VIOLATIONS_FILTER_UNSPECIFIED
+		}
+	}
+
 	resp, err := client.List(context.Background(), req)
 	if err != nil {
 		return nil, err
@@ -145,6 +159,7 @@ func pbWorkflowRunItemToAction(in *pb.WorkflowRunItem) *WorkflowRunItem {
 			Version:    in.GetVersion().GetVersion(),
 			Prerelease: in.GetVersion().GetPrerelease(),
 		},
+		PolicyStatus: humanizedPolicyStatus(in.HasPolicyViolations),
 	}
 
 	if in.GetContractVersion() != nil {
@@ -158,6 +173,16 @@ func pbWorkflowRunItemToAction(in *pb.WorkflowRunItem) *WorkflowRunItem {
 	return item
 }
 
+func humanizedPolicyStatus(hasPolicyViolations *bool) string {
+	if hasPolicyViolations == nil {
+		return "N/A"
+	}
+	if *hasPolicyViolations {
+		return "failed"
+	}
+	return "passed"
+}
+
 func humanizedRunnerType(in v1.CraftingSchema_Runner_RunnerType) string {
 	mapping := map[v1.CraftingSchema_Runner_RunnerType]string{
 		*v1.CraftingSchema_Runner_RUNNER_TYPE_UNSPECIFIED.Enum(): "Unspecified",