feat: org setting to skip storing runner-discovered env vars in attestations (#3177)

Author: migmartri

app/cli/cmd/organization_update.go

@@ -33,6 +33,7 @@ func newOrganizationUpdateCmd() *cobra.Command {
 		apiTokenMaxDaysInactive             string
 		enableAIAgentCollector              bool
 		blockAttestationsOnReleasedVersions bool
+		skipRunnerEnvVars                   bool
 	)
 
 	cmd := &cobra.Command{
@@ -64,6 +65,10 @@ func newOrganizationUpdateCmd() *cobra.Command {
 				opts.BlockAttestationsOnReleasedVersions = &blockAttestationsOnReleasedVersions
 			}
 
+			if cmd.Flags().Changed("skip-runner-env-vars") {
+				opts.SkipRunnerEnvVars = &skipRunnerEnvVars
+			}
+
 			if cmd.Flags().Changed("api-token-max-days-inactive") {
 				days, err := strconv.Atoi(apiTokenMaxDaysInactive)
 				if err != nil {
@@ -96,5 +101,6 @@ func newOrganizationUpdateCmd() *cobra.Command {
 	cmd.Flags().StringVar(&apiTokenMaxDaysInactive, "api-token-max-days-inactive", "", "maximum days of inactivity before API tokens are auto-revoked (e.g. '90', '0' to disable)")
 	cmd.Flags().BoolVar(&enableAIAgentCollector, "enable-ai-agent-collector", false, "enable automatic AI agent config collection during attestation init")
 	cmd.Flags().BoolVar(&blockAttestationsOnReleasedVersions, "block-attestations-on-released-versions", false, "reject new attestations pushed to project versions that are already released")
+	cmd.Flags().BoolVar(&skipRunnerEnvVars, "skip-runner-env-vars", false, "opt out of storing the environment variables automatically discovered by the CI runner in the attestation")
 	return cmd
 }

app/cli/documentation/cli-reference.mdx

@@ -2917,6 +2917,7 @@ Options
 --policies-allowed-hostnames strings        set the allowed hostnames for the policy engine
 --prevent-implicit-workflow-creation        prevent workflows and projects from being created implicitly during attestation init
 --restrict-contract-creation                restrict contract creation (org-level and project-level) to only organization admins (owner/admin roles)
+--skip-runner-env-vars                      opt out of storing the environment variables automatically discovered by the CI runner in the attestation
 ```
 
 Options inherited from parent commands

app/cli/pkg/action/attestation_init.go

@@ -200,6 +200,7 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 		blockOnPolicyViolation   bool
 		policiesAllowedHostnames []string
 		enableAIAgentCollector   bool
+		skipRunnerEnvVars        bool
 		// Timestamp Authority URL for new attestations
 		timestampAuthorityURL, signingCAName string
 		uiDashboardURL                       string
@@ -233,6 +234,7 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 		blockOnPolicyViolation = result.GetBlockOnPolicyViolation()
 		policiesAllowedHostnames = result.GetPoliciesAllowedHostnames()
 		enableAIAgentCollector = result.GetEnableAiAgentCollector()
+		skipRunnerEnvVars = result.GetSkipRunnerEnvVars()
 		signingOpts := result.GetSigningOptions()
 		timestampAuthorityURL = signingOpts.GetTimestampAuthorityUrl()
 		signingCAName = signingOpts.GetSigningCa()
@@ -291,6 +293,7 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 		Runner:                   discoveredRunner,
 		BlockOnPolicyViolation:   blockOnPolicyViolation,
 		PoliciesAllowedHostnames: policiesAllowedHostnames,
+		SkipRunnerEnvVars:        skipRunnerEnvVars,
 		SigningOptions: &crafter.SigningOpts{
 			TimestampAuthorityURL: timestampAuthorityURL,
 			SigningCAName:         signingCAName,

app/cli/pkg/action/membership_list.go

@@ -38,6 +38,7 @@ type OrgItem struct {
 	APITokenMaxDaysInactive             *string    `json:"apiTokenMaxDaysInactive,omitempty"`
 	EnableAIAgentCollector              bool       `json:"enableAiAgentCollector"`
 	BlockAttestationsOnReleasedVersions bool       `json:"blockAttestationsOnReleasedVersions"`
+	SkipRunnerEnvVars                   bool       `json:"skipRunnerEnvVars"`
 }
 
 type MembershipItem struct {
@@ -142,6 +143,7 @@ func pbOrgItemToAction(in *pb.OrgItem) *OrgItem {
 		PreventImplicitWorkflowCreation:     in.PreventImplicitWorkflowCreation,
 		EnableAIAgentCollector:              in.EnableAiAgentCollector,
 		BlockAttestationsOnReleasedVersions: in.BlockAttestationsOnReleasedVersions,
+		SkipRunnerEnvVars:                   in.SkipRunnerEnvVars,
 	}
 
 	if in.DefaultPolicyViolationStrategy == pb.OrgItem_POLICY_VIOLATION_BLOCKING_STRATEGY_BLOCK {

app/cli/pkg/action/org_update.go

@@ -42,6 +42,8 @@ type NewOrgUpdateOpts struct {
 	EnableAIAgentCollector *bool
 	// BlockAttestationsOnReleasedVersions rejects new attestations pushed to project versions that are already released
 	BlockAttestationsOnReleasedVersions *bool
+	// SkipRunnerEnvVars opts out of storing the environment variables automatically discovered by the CI runner in the attestation
+	SkipRunnerEnvVars *bool
 }
 
 func (action *OrgUpdate) Run(ctx context.Context, name string, opts *NewOrgUpdateOpts) (*OrgItem, error) {
@@ -54,6 +56,7 @@ func (action *OrgUpdate) Run(ctx context.Context, name string, opts *NewOrgUpdat
 		RestrictContractCreationToOrgAdmins: opts.RestrictContractCreation,
 		EnableAiAgentCollector:              opts.EnableAIAgentCollector,
 		BlockAttestationsOnReleasedVersions: opts.BlockAttestationsOnReleasedVersions,
+		SkipRunnerEnvVars:                   opts.SkipRunnerEnvVars,
 	}
 
 	if opts.PoliciesAllowedHostnames != nil {

app/controlplane/api/controlplane/v1/organization.pb.go

@@ -108,6 +108,9 @@ message OrganizationServiceUpdateRequest {
 
   // Reject new attestations pushed to project versions that are already released (prerelease == false)
   optional bool block_attestations_on_released_versions = 9;
+
+  // Opt out of storing the environment variables automatically discovered by the CI runner in the attestation
+  optional bool skip_runner_env_vars = 10;
 }
 
 message OrganizationServiceUpdateResponse {

app/controlplane/api/controlplane/v1/organization.proto

@@ -393,6 +393,8 @@ message OrgItem {
   bool enable_ai_agent_collector = 10;
   // Whether new attestations are rejected on project versions that are already released (prerelease == false)
   bool block_attestations_on_released_versions = 11;
+  // Whether the environment variables automatically discovered by the CI runner are skipped from the attestation
+  bool skip_runner_env_vars = 12;
 
   enum PolicyViolationBlockingStrategy {
     POLICY_VIOLATION_BLOCKING_STRATEGY_UNSPECIFIED = 0;