perf(crafter): avoid redundant SHA256 pass when uploading materials to CAS

uploadAndCraft already computes the artifact's SHA256 via fileStats, then
called Uploader.UploadFile which re-opened the file and re-hashed it before
streaming. Switch to Uploader.Upload with the reader and digest from
fileStats so the file is opened once and hashed once per material.

Also fix a file-handle leak in fileStats when SHA256 or Seek fails.

Chainloop-Trace-Sessions: 70c6c792-4598-426b-9e75-482bcb10498f

Signed-off-by: Matías Insaurralde <matias@chainloop.dev>

Author: matiasinsaurralde

pkg/attestation/crafter/crafter_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2023-2025 The Chainloop Authors.
+// Copyright 2023-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -40,6 +40,7 @@ import (
 	"github.com/go-git/go-git/v6/config"
 	"github.com/go-git/go-git/v6/plumbing/object"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
 	"google.golang.org/protobuf/encoding/protojson"
@@ -609,7 +610,7 @@ func (s *crafterSuite) TestAddMaterialsAutomatic() {
 			uploader := mUploader.NewUploader(s.T())
 
 			if !tc.uploadArtifact {
-				uploader.On("UploadFile", context.Background(), tc.materialPath).
+				uploader.On("Upload", context.Background(), mock.Anything, mock.Anything, mock.Anything).
 					Return(&casclient.UpDownStatus{
 						Digest:   "deadbeef",
 						Filename: "simple.txt",

pkg/attestation/crafter/materials/artifact_test.go

@@ -28,6 +28,7 @@ import (
 	mUploader "github.com/chainloop-dev/chainloop/pkg/casclient/mocks"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -76,7 +77,7 @@ func TestArtifactCraft(t *testing.T) {
 
 	// Mock uploader
 	uploader := mUploader.NewUploader(t)
-	uploader.On("UploadFile", context.TODO(), "./testdata/simple.txt").
+	uploader.On("Upload", context.TODO(), mock.Anything, mock.Anything, mock.Anything).
 		Return(&casclient.UpDownStatus{
 			Digest:   "deadbeef",
 			Filename: "simple.txt",

pkg/attestation/crafter/materials/asyncapi_test.go

@@ -27,6 +27,7 @@ import (
 	mUploader "github.com/chainloop-dev/chainloop/pkg/casclient/mocks"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -143,7 +144,7 @@ func TestAsyncAPICraft(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			uploader := mUploader.NewUploader(t)
 			if tc.wantErr == "" {
-				uploader.On("UploadFile", context.TODO(), tc.filePath).
+				uploader.On("Upload", context.TODO(), mock.Anything, mock.Anything, mock.Anything).
 					Return(&casclient.UpDownStatus{
 						Digest:   "deadbeef",
 						Filename: "spec.json",
@@ -178,7 +179,7 @@ func TestAsyncAPICraft(t *testing.T) {
 func TestAsyncAPICraftNoStrictValidation(t *testing.T) {
 	l := zerolog.Nop()
 	uploader := mUploader.NewUploader(t)
-	uploader.On("UploadFile", context.TODO(), "./testdata/asyncapi-invalid.json").
+	uploader.On("Upload", context.TODO(), mock.Anything, mock.Anything, mock.Anything).
 		Return(&casclient.UpDownStatus{
 			Digest:   "deadbeef",
 			Filename: "spec.json",

pkg/attestation/crafter/materials/attestation_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -136,7 +136,7 @@ func TestAttestationCraft(t *testing.T) {
 			// Mock uploader
 			uploader := mUploader.NewUploader(t)
 			if !tc.expectErr {
-				uploader.On("UploadFile", context.Background(), mock.Anything).
+				uploader.On("Upload", context.Background(), mock.Anything, mock.Anything, mock.Anything).
 					Return(&casclient.UpDownStatus{
 						Digest:   "deadbeef",
 						Filename: "attestation.json",

pkg/attestation/crafter/materials/blackduck_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -26,6 +26,7 @@ import (
 	mUploader "github.com/chainloop-dev/chainloop/pkg/casclient/mocks"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -77,7 +78,7 @@ func TestBlackduckJSONCraft(t *testing.T) {
 			// Mock uploader
 			uploader := mUploader.NewUploader(t)
 			if tc.wantErr == "" {
-				uploader.On("UploadFile", context.TODO(), tc.filePath).
+				uploader.On("Upload", context.TODO(), mock.Anything, mock.Anything, mock.Anything).
 					Return(&casclient.UpDownStatus{}, nil)
 			}
 

pkg/attestation/crafter/materials/chainloop_ai_agent_config_test.go

@@ -29,6 +29,7 @@ import (
 	mUploader "github.com/chainloop-dev/chainloop/pkg/casclient/mocks"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -288,7 +289,7 @@ func TestChainloopAIAgentConfigCrafter_AgentNameAnnotation(t *testing.T) {
 			}
 
 			uploader := mUploader.NewUploader(t)
-			uploader.On("UploadFile", context.TODO(), tc.filePath).
+			uploader.On("Upload", context.TODO(), mock.Anything, mock.Anything, mock.Anything).
 				Return(&casclient.UpDownStatus{
 					Digest:   "deadbeef",
 					Filename: tc.filePath,

pkg/attestation/crafter/materials/chainloop_ai_coding_session_test.go

@@ -29,6 +29,7 @@ import (
 	mUploader "github.com/chainloop-dev/chainloop/pkg/casclient/mocks"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -327,7 +328,7 @@ func TestChainloopAICodingSessionCrafter_Annotations(t *testing.T) {
 			}
 
 			uploader := mUploader.NewUploader(t)
-			uploader.On("UploadFile", context.TODO(), tc.filePath).
+			uploader.On("Upload", context.TODO(), mock.Anything, mock.Anything, mock.Anything).
 				Return(&casclient.UpDownStatus{
 					Digest:   "deadbeef",
 					Filename: tc.filePath,

pkg/attestation/crafter/materials/csaf_test.go

@@ -28,6 +28,7 @@ import (
 	mUploader "github.com/chainloop-dev/chainloop/pkg/casclient/mocks"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -220,7 +221,7 @@ func TestCSAFCraft(t *testing.T) {
 			// Mock uploader
 			uploader := mUploader.NewUploader(t)
 			if tc.wantErr == "" {
-				uploader.On("UploadFile", context.TODO(), tc.filePath).
+				uploader.On("Upload", context.TODO(), mock.Anything, mock.Anything, mock.Anything).
 					Return(&casclient.UpDownStatus{
 						Digest:   "deadbeef",
 						Filename: "vex.json",

pkg/attestation/crafter/materials/cyclonedxjson_test.go

@@ -26,6 +26,7 @@ import (
 	mUploader "github.com/chainloop-dev/chainloop/pkg/casclient/mocks"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -212,7 +213,7 @@ func TestCyclonedxJSONCraft(t *testing.T) {
 			// Mock uploader
 			uploader := mUploader.NewUploader(t)
 			if tc.wantErr == "" {
-				uploader.On("UploadFile", context.TODO(), tc.filePath).
+				uploader.On("Upload", context.TODO(), mock.Anything, mock.Anything, mock.Anything).
 					Return(&casclient.UpDownStatus{}, nil)
 			}
 
@@ -304,7 +305,7 @@ func TestCycloneDXJSONCraftNoStrictValidation(t *testing.T) {
 			// Mock uploader
 			uploader := mUploader.NewUploader(t)
 			if tc.wantErr == "" {
-				uploader.On("UploadFile", context.TODO(), tc.filePath).
+				uploader.On("Upload", context.TODO(), mock.Anything, mock.Anything, mock.Anything).
 					Return(&casclient.UpDownStatus{}, nil)
 			}
 
@@ -358,7 +359,7 @@ func TestCycloneDXJSONCraft_SkipUpload(t *testing.T) {
 			// Mock uploader - only expect upload call if not skipped
 			uploader := mUploader.NewUploader(t)
 			if tc.wantUpload {
-				uploader.On("UploadFile", context.TODO(), filePath).
+				uploader.On("Upload", context.TODO(), mock.Anything, mock.Anything, mock.Anything).
 					Return(&casclient.UpDownStatus{
 						Digest:   "deadbeef",
 						Filename: "sbom.cyclonedx.json",

pkg/attestation/crafter/materials/evidence_test.go

@@ -28,6 +28,7 @@ import (
 	mUploader "github.com/chainloop-dev/chainloop/pkg/casclient/mocks"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -76,7 +77,7 @@ func TestEvidenceCraft(t *testing.T) {
 
 	// Mock uploader
 	uploader := mUploader.NewUploader(t)
-	uploader.On("UploadFile", context.TODO(), "./testdata/simple.txt").
+	uploader.On("Upload", context.TODO(), mock.Anything, mock.Anything, mock.Anything).
 		Return(&casclient.UpDownStatus{
 			Digest:   "deadbeef",
 			Filename: "simple.txt",
@@ -213,7 +214,7 @@ func TestEvidenceCraftWithJSONAnnotations(t *testing.T) {
 
 			// Create a new mock uploader for each test case
 			uploader := mUploader.NewUploader(t)
-			uploader.On("UploadFile", context.TODO(), tc.filePath).
+			uploader.On("Upload", context.TODO(), mock.Anything, mock.Anything, mock.Anything).
 				Return(&casclient.UpDownStatus{
 					Digest:   "deadbeef",
 					Filename: tc.filePath,