perform wasm validation on lint

Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Author: javirln

app/cli/internal/policydevel/lint.go

@@ -28,6 +28,7 @@ import (
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/unmarshal"
 	"github.com/chainloop-dev/chainloop/pkg/policies/engine"
 	"github.com/chainloop-dev/chainloop/pkg/resourceloader"
+	extism "github.com/extism/go-sdk"
 	opaAst "github.com/open-policy-agent/opa/v1/ast"
 	"github.com/open-policy-agent/opa/v1/format"
 	"github.com/styrainc/regal/pkg/config"
@@ -158,12 +159,30 @@ func (p *PolicyToLint) loadReferencedPolicyFiles(baseDir string) error {
 }
 
 func (p *PolicyToLint) processFile(filePath string) error {
+	ext := strings.ToLower(filepath.Ext(filePath))
+
+	// WASM files: validate magic bytes
+	if ext == ".wasm" {
+		content, err := os.ReadFile(filePath)
+		if err != nil {
+			return fmt.Errorf("failed to read WASM file %s: %w", filePath, err)
+		}
+
+		// Verify magic bytes
+		if engine.DetectPolicyType(content) != engine.PolicyTypeWASM {
+			return fmt.Errorf("file has .wasm extension but is not a valid WASM file")
+		}
+
+		p.WASMFiles = append(p.WASMFiles, &File{Path: filePath, Content: content})
+		return nil
+	}
+
+	// Other files: read full content
 	content, err := os.ReadFile(filePath)
 	if err != nil {
 		return err
 	}
 
-	ext := strings.ToLower(filepath.Ext(filePath))
 	switch ext {
 	case ".yaml", ".yml":
 		p.YAMLFiles = append(p.YAMLFiles, &File{
@@ -175,16 +194,6 @@ func (p *PolicyToLint) processFile(filePath string) error {
 			Path:    filePath,
 			Content: content,
 		})
-	case ".wasm":
-		// Detect if file is actually WASM using magic bytes
-		policyType := engine.DetectPolicyType(content)
-		if policyType != engine.PolicyTypeWASM {
-			return fmt.Errorf("file has .wasm extension but is not a valid WASM file")
-		}
-		p.WASMFiles = append(p.WASMFiles, &File{
-			Path:    filePath,
-			Content: content,
-		})
 	default:
 		return fmt.Errorf("unsupported file extension %s, must be .yaml/.yml, .rego, or .wasm", ext)
 	}
@@ -198,8 +207,10 @@ func (p *PolicyToLint) Validate() {
 		p.validateRegoFile(regoFile)
 	}
 
-	// WASM files are binary and cannot be linted
-	// Only verify they have valid WASM magic bytes (already done in processFile)
+	// Validate WASM files
+	for _, wasmFile := range p.WASMFiles {
+		p.validateWasmFile(wasmFile)
+	}
 }
 
 func (p *PolicyToLint) validateRegoFile(file *File) {
@@ -215,6 +226,35 @@ func (p *PolicyToLint) validateRegoFile(file *File) {
 	}
 }
 
+// validateWasmFile validates a WASM policy file by checking that it exports the required Execute function
+func (p *PolicyToLint) validateWasmFile(file *File) {
+	ctx := context.Background()
+
+	// Create Extism manifest
+	manifest := extism.Manifest{
+		Wasm: []extism.Wasm{
+			extism.WasmData{Data: file.Content},
+		},
+	}
+
+	cfg := extism.PluginConfig{
+		EnableWasi: true,
+	}
+
+	// Create plugin
+	plugin, err := extism.NewPlugin(ctx, manifest, cfg, []extism.HostFunction{})
+	if err != nil {
+		p.AddError(file.Path, fmt.Sprintf("failed to load WASM module: %v", err), 0)
+		return
+	}
+	defer plugin.Close(ctx)
+
+	// Check if Execute function is exported
+	if !plugin.FunctionExists("Execute") {
+		p.AddError(file.Path, "WASM module missing required 'Execute' function export", 0)
+	}
+}
+
 func (p *PolicyToLint) validateAndFormatRego(content, path string) string {
 	// 1. Optionally format
 	if p.Format {

pkg/policies/engine/wasm/engine.go

@@ -30,6 +30,10 @@ import (
 // Ensure Engine implements PolicyEngine interface
 var _ engine.PolicyEngine = (*Engine)(nil)
 
+// entryFunction is the name of the function to call in the WASM module.
+// The engine expects this function to be present.
+const entryFunction = "Execute"
+
 // Engine implements the PolicyEngine interface for WASM policies
 type Engine struct {
 	executionTimeout time.Duration
@@ -147,6 +151,12 @@ func (e *Engine) Verify(ctx context.Context, policy *engine.Policy, input []byte
 	}
 	defer plugin.Close(ctx)
 
+	// Check if Execute function is exported
+	if !plugin.FunctionExists(entryFunction) {
+		e.logger.Error().Str("policy", policy.Name).Str("function", entryFunction).Msg("WASM module missing required function export")
+		return nil, fmt.Errorf("wasm module validation failed: missing required '%s' function export", entryFunction)
+	}
+
 	// Set up logger for WASM plugin output
 	plugin.SetLogger(func(level extism.LogLevel, message string) {
 		switch level {
@@ -172,7 +182,7 @@ func (e *Engine) Verify(ctx context.Context, policy *engine.Policy, input []byte
 	e.logger.Debug().Str("policy", policy.Name).Dur("timeout", e.executionTimeout).Msg("Executing WASM policy with raw material input")
 
 	// Pass raw material bytes as input (args are in config)
-	exit, output, err := plugin.CallWithContext(execCtx, "Execute", input)
+	exit, output, err := plugin.CallWithContext(execCtx, entryFunction, input)
 	if err != nil {
 		// Parse the error to provide user-friendly messages
 		parsedErr := parseWasmError(err)