refactor(policies): simplify findings/violations handling after review

- Fix behavioral divergence between Rego and WASM engines for empty
  findings: both now use len>0 check consistently
- Gracefully handle missing violations when findings is absent (no
  default findings array required in policies)
- Pre-allocate violations slice in WASM engine
- Trim redundant deprecation comments

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

pkg/policies/engine/rego/rego.go

@@ -210,11 +210,9 @@ func parseResultRule(res rego.ResultSet, policy *engine.Policy, rawData *engine.
 			result.SkipReason = reason
 			result.Ignore = ignore
 
-			// Try "findings" first (new format, structured objects).
-			// When present it fully replaces "violations", providing backward
-			// compatibility: old CLIs that only understand string violations
-			// ignore the unknown "findings" key.
-			if findingsRaw, ok := ruleResult["findings"].([]any); ok {
+			// Prefer non-empty "findings" (structured objects) over "violations" for backward compatibility.
+			findingsRaw, _ := ruleResult["findings"].([]any)
+			if len(findingsRaw) > 0 {
 				for _, f := range findingsRaw {
 					obj, ok := f.(map[string]any)
 					if !ok {
@@ -226,20 +224,14 @@ func parseResultRule(res rego.ResultSet, policy *engine.Policy, rawData *engine.
 					}
 					result.Violations = append(result.Violations, pv)
 				}
-			} else {
-				// Fallback: violations (strings or structured objects).
-				// Structured objects in violations are deprecated — use findings instead.
-				violations, ok := ruleResult["violations"].([]any)
-				if !ok {
-					return nil, engine.ResultFormatError{Field: "violations"}
-				}
+			} else if violations, ok := ruleResult["violations"].([]any); ok {
+				// Fallback: violations (strings or deprecated structured objects).
+				// TODO: remove structured object support once policies are fully migrated to findings.
 				for _, violation := range violations {
 					switch v := violation.(type) {
 					case string:
 						result.Violations = append(result.Violations, &engine.PolicyViolation{Subject: policy.Name, Violation: v})
 					case map[string]any:
-						// Deprecated: structured objects in violations will be removed in a future release.
-						// Migrate to the "findings" field instead.
 						pv, err := engine.NewStructuredViolation(policy.Name, v)
 						if err != nil {
 							return nil, fmt.Errorf("structured violation in policy %q: %w", policy.Name, err)
@@ -250,6 +242,7 @@ func parseResultRule(res rego.ResultSet, policy *engine.Policy, rawData *engine.
 					}
 				}
 			}
+			// If neither findings nor violations is present, result has zero violations.
 		}
 	}
 

pkg/policies/engine/wasm/engine.go

@@ -206,11 +206,11 @@ func (e *Engine) Verify(ctx context.Context, policy *engine.Policy, input []byte
 		Skipped:    result.Skipped,
 		SkipReason: result.SkipReason,
 		Ignore:     result.Ignore,
-		Violations: make([]*engine.PolicyViolation, 0),
 	}
 
-	// "findings" (structured objects) takes precedence over "violations"
+	// Prefer non-empty "findings" (structured objects) over "violations" for backward compatibility.
 	if len(result.Findings) > 0 {
+		evalResult.Violations = make([]*engine.PolicyViolation, 0, len(result.Findings))
 		for _, raw := range result.Findings {
 			pv, err := parseWasmFinding(policy.Name, raw)
 			if err != nil {
@@ -219,8 +219,8 @@ func (e *Engine) Verify(ctx context.Context, policy *engine.Policy, input []byte
 			evalResult.Violations = append(evalResult.Violations, pv)
 		}
 	} else {
-		// Fallback: violations (strings or structured objects).
-		// Structured objects in violations are deprecated — use findings instead.
+		// Fallback: violations (strings or deprecated structured objects).
+		evalResult.Violations = make([]*engine.PolicyViolation, 0, len(result.Violations))
 		for _, raw := range result.Violations {
 			pv, err := parseWasmViolation(policy.Name, raw)
 			if err != nil {
@@ -267,8 +267,6 @@ func parseWasmViolation(policyName string, raw json.RawMessage) (*engine.PolicyV
 			Violation: typed,
 		}, nil
 	case map[string]any:
-		// Deprecated: structured objects in violations will be removed in a future release.
-		// Migrate to the "findings" field instead.
 		return engine.NewStructuredViolation(policyName, typed)
 	default:
 		return nil, fmt.Errorf("violation must be a string or object, got %T", v)