feat(contract): reject attestation level policies in materials

[Piskoo]

This PR adds validation to contract creation and update, that prevents assigning policies that contain execution path for kind ATTESTATION on material level.

Example:

For sbom-present policy

apiVersion: workflowcontract.chainloop.dev/v1
kind: Policy
metadata:
  name: sbom-present
  description: desc
spec:
  policies:
    - kind: ATTESTATION
      path: sbom-present.rego

Valid contract

schema_version: v1
policies:
  attestation:
    - ref: sbom-present

Passes, the contract is created/updated

Invalid contract

schema_version: v1
policies:
  materials:
    - ref: sbom-present

Returns

ERR validation error: attestation policy "sbom-present" cannot be attached to materials
exit status 1

Already existing contracts are unaffected, invalid contract will also fail if raw contract is given during att init in --contract flag.

[migmartri]

we need to review this because we support providing ATTESTATION as material type. But maybe the key here is to make sure it's not the only option. cc/ @jiparis

[jiparis]

ATTESTATION policies can be designed to run against an attestation material, or against the attestation itself (or both), but I don't think we have enough information at this point to know it, even if it's the only execution path.

In my opinion, we have two options:

• change the semantics so that ATTESTATION materials are not allowed anymore (what this PR is implementing).
• or some kind of metadata in the policy that allow policy authors to specify how the policy should be run.

[Piskoo]

We could also "double check" if the users' intention was to apply attestation policy to a material, to do that we could require a selector

[migmartri]

What policies do we have that use an attestation as the material?

[github-actions]

This pull request is stale because it has been open for 60 days with no activity. It will be closed in 7 days if no further activity occurs.

[github-actions]

This pull request was closed because it has been inactive for 7 days since being marked as stale. Feel free to reopen if it is still relevant.