fix: address PR review feedback

- Use CI_MERGE_REQUEST_PROJECT_PATH for fork-based GitLab MRs,
  falling back to CI_PROJECT_PATH
- Add v1.0 schema backward compatibility tests
- Add integration test for GitLab MR metadata with reviewers via API

Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Author: jiparis

internal/prinfo/prinfo_test.go

@@ -184,3 +184,49 @@ func TestValidatePRInfo(t *testing.T) {
 		})
 	}
 }
+
+func TestValidatePRInfoV1_0BackwardCompat(t *testing.T) {
+	testCases := []struct {
+		name    string
+		data    string
+		wantErr bool
+	}{
+		{
+			name: "v1.0 valid PR without reviewers",
+			data: `{
+				"platform": "github",
+				"type": "pull_request",
+				"number": "123",
+				"url": "https://github.com/owner/repo/pull/123",
+				"author": "username"
+			}`,
+			wantErr: false,
+		},
+		{
+			name: "v1.0 rejects reviewers field",
+			data: `{
+				"platform": "github",
+				"type": "pull_request",
+				"number": "123",
+				"url": "https://github.com/owner/repo/pull/123",
+				"reviewers": [{"login": "reviewer1", "type": "User"}]
+			}`,
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var data interface{}
+			err := json.Unmarshal([]byte(tc.data), &data)
+			require.NoError(t, err)
+
+			err = schemavalidators.ValidatePRInfo(data, schemavalidators.PRInfoVersion1_0)
+			if tc.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}

pkg/attestation/crafter/materials/chainloop_pr_info_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2025 The Chainloop Authors.
+// Copyright 2025-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -129,6 +129,27 @@ func TestChainloopPRInfoCrafter_Validation(t *testing.T) {
 	}
 }
 
+func TestChainloopPRInfoCrafter_V1_0BackwardCompat(t *testing.T) {
+	// Data without reviewers should still validate against v1.0
+	data := prinfo.Data{
+		Platform: "github",
+		Type:     "pull_request",
+		Number:   "123",
+		URL:      "https://github.com/org/repo/pull/123",
+		Author:   "testuser",
+	}
+
+	dataBytes, err := json.Marshal(data)
+	require.NoError(t, err)
+
+	var rawData interface{}
+	err = json.Unmarshal(dataBytes, &rawData)
+	require.NoError(t, err)
+
+	err = schemavalidators.ValidatePRInfo(rawData, schemavalidators.PRInfoVersion1_0)
+	require.NoError(t, err)
+}
+
 func TestChainloopPRInfoCrafter_InvalidJSON(t *testing.T) {
 	tmpDir := t.TempDir()
 	tmpFile := filepath.Join(tmpDir, "invalid.json")

pkg/attestation/crafter/prmetadata.go

@@ -163,8 +163,13 @@ func extractGitLabMRMetadata(ctx context.Context, envVars map[string]string) (bo
 	projectURL := envVars["CI_MERGE_REQUEST_PROJECT_URL"]
 	mrURL := fmt.Sprintf("%s/-/merge_requests/%s", projectURL, mrIID)
 
-	// Fetch reviewers from GitLab API (best-effort)
-	reviewers := fetchGitLabReviewers(ctx, os.Getenv("CI_SERVER_URL"), os.Getenv("CI_PROJECT_PATH"), mrIID, os.Getenv("CI_JOB_TOKEN"))
+	// Fetch reviewers from GitLab API (best-effort).
+	// Prefer CI_MERGE_REQUEST_PROJECT_PATH for fork-based MRs where CI_PROJECT_PATH points to the fork.
+	projectPath := os.Getenv("CI_MERGE_REQUEST_PROJECT_PATH")
+	if projectPath == "" {
+		projectPath = os.Getenv("CI_PROJECT_PATH")
+	}
+	reviewers := fetchGitLabReviewers(ctx, os.Getenv("CI_SERVER_URL"), projectPath, mrIID, os.Getenv("CI_JOB_TOKEN"))
 
 	metadata := &PRMetadata{
 		Platform:     "gitlab",

pkg/attestation/crafter/prmetadata_test.go

@@ -304,3 +304,35 @@ func TestFetchGitLabReviewersRequestPath(t *testing.T) {
 
 	fetchGitLabReviewers(context.Background(), server.URL, "group/project", "42", "token")
 }
+
+func TestExtractGitLabMRMetadataWithReviewers(t *testing.T) {
+	// Set up a mock GitLab API that returns reviewers
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprint(w, `{"reviewers": [{"username": "alice"}, {"username": "coderabbitai"}]}`)
+	}))
+	defer server.Close()
+
+	// Set env vars that extractGitLabMRMetadata reads via os.Getenv for the API call
+	t.Setenv("CI_SERVER_URL", server.URL)
+	t.Setenv("CI_MERGE_REQUEST_PROJECT_PATH", "group/project")
+	t.Setenv("CI_JOB_TOKEN", "test-token")
+
+	envVars := map[string]string{
+		"CI_PIPELINE_SOURCE":                  "merge_request_event",
+		"CI_MERGE_REQUEST_IID":                "10",
+		"CI_MERGE_REQUEST_TITLE":              "MR with reviewers",
+		"CI_MERGE_REQUEST_PROJECT_URL":        "https://gitlab.com/group/project",
+		"GITLAB_USER_LOGIN":                   "author",
+		"CI_MERGE_REQUEST_SOURCE_BRANCH_NAME": "feature",
+		"CI_MERGE_REQUEST_TARGET_BRANCH_NAME": "main",
+	}
+
+	isMR, metadata, err := extractGitLabMRMetadata(context.Background(), envVars)
+	require.NoError(t, err)
+	require.True(t, isMR)
+	require.Len(t, metadata.Reviewers, 2)
+	assert.Equal(t, "alice", metadata.Reviewers[0].Login)
+	assert.Equal(t, "unknown", metadata.Reviewers[0].Type)
+	assert.Equal(t, "coderabbitai", metadata.Reviewers[1].Login)
+}