From 838724c49c5a3daec25965678214e12b7faedeef Mon Sep 17 00:00:00 2001 From: Sylwester Piskozub Date: Wed, 17 Dec 2025 12:45:43 +0100 Subject: [PATCH 1/2] fail att add when gated policy contains violations Signed-off-by: Sylwester Piskozub --- app/cli/cmd/attestation_add.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/app/cli/cmd/attestation_add.go b/app/cli/cmd/attestation_add.go index e4e377db4..88d1f26b2 100644 --- a/app/cli/cmd/attestation_add.go +++ b/app/cli/cmd/attestation_add.go @@ -119,6 +119,15 @@ func newAttestationAddCmd() *cobra.Command { return err } + // Check for gated policy violations + for _, evaluations := range policies { + for _, eval := range evaluations { + if len(eval.Violations) > 0 && eval.Gate { + return NewGateError(eval.Name) + } + } + } + return output.EncodeOutput(flagOutputFormat, resp, func(s *action.AttestationStatusMaterial) error { return displayMaterialInfo(s, policies[resp.Name]) }) From fd3cbbcfe75e63f743f357034ae08538ae1d6b8c Mon Sep 17 00:00:00 2001 From: Sylwester Piskozub Date: Wed, 17 Dec 2025 13:59:48 +0100 Subject: [PATCH 2/2] display output before fail Signed-off-by: Sylwester Piskozub --- app/cli/cmd/attestation_add.go | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/app/cli/cmd/attestation_add.go b/app/cli/cmd/attestation_add.go index 88d1f26b2..ca7334d30 100644 --- a/app/cli/cmd/attestation_add.go +++ b/app/cli/cmd/attestation_add.go @@ -119,6 +119,12 @@ func newAttestationAddCmd() *cobra.Command { return err } + if err := output.EncodeOutput(flagOutputFormat, resp, func(s *action.AttestationStatusMaterial) error { + return displayMaterialInfo(s, policies[resp.Name]) + }); err != nil { + return err + } + // Check for gated policy violations for _, evaluations := range policies { for _, eval := range evaluations { @@ -128,9 +134,7 @@ func newAttestationAddCmd() *cobra.Command { } } - return output.EncodeOutput(flagOutputFormat, resp, func(s *action.AttestationStatusMaterial) error { - return displayMaterialInfo(s, policies[resp.Name]) - }) + return nil }, ) },