feat: add material size annotation to attestations

[migmartri]

Summary

• Add chainloop.material.size built-in annotation that records the material size in bytes
• Applies to all file-based material types (artifacts, SBOMs, SARIF, etc.) and STRING materials
• Follows existing chainloop.material.* annotation naming convention

Example output after adding a material:

┌─────────────┬─────────────────────────────────────────────────────────────────────────┐
│ Name        │ artifact                                                                │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Type        │ ARTIFACT                                                                │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Required    │ No                                                                      │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Value       │ 20240415_123801.jpg                                                     │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Digest      │ sha256:d7f73a24a4bfe62d0024db940db13fca9bcf17040151b9607e6e52ec75b03f97 │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Annotations │ ------                                                                  │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│             │ chainloop.material.size: 1023852                                        │
└─────────────┴─────────────────────────────────────────────────────────────────────────┘

In the final in-toto attestation:

"materials": [
   {
      "annotations": {
         "chainloop.material.cas": true,
         "chainloop.material.name": "artifact",
         "chainloop.material.size": "1023852",
         "chainloop.material.type": "ARTIFACT"
      },
      "digest": {
         "sha256": "d7f73a24a4bfe62d0024db940db13fca9bcf17040151b9607e6e52ec75b03f97"
      },
      "name": "20240415_123801.jpg"
   }
]

Closes #2847

[cubic-dev-ai]

1 issue found across 7 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/attestation/crafter/prmetadata_test.go">

<violation number="1" location="pkg/attestation/crafter/prmetadata_test.go:30">
P2: This test re-implements the temp-file naming logic instead of exercising `AutoCollectPRMetadata`, so it mainly verifies `os.CreateTemp` behavior and can miss regressions in the actual PR-metadata path.

(Based on your team's feedback about adding tests for the actual new code path.) [FEEDBACK_USED]</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: This test re-implements the temp-file naming logic instead of exercising AutoCollectPRMetadata, so it mainly verifies os.CreateTemp behavior and can miss regressions in the actual PR-metadata path.

(Based on your team's feedback about adding tests for the actual new code path.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/attestation/crafter/prmetadata_test.go, line 30:

<comment>This test re-implements the temp-file naming logic instead of exercising `AutoCollectPRMetadata`, so it mainly verifies `os.CreateTemp` behavior and can miss regressions in the actual PR-metadata path.

(Based on your team's feedback about adding tests for the actual new code path.) </comment>

<file context>
@@ -16,13 +16,26 @@
 
+func TestPRMetadataTempFileHasJSONExtension(t *testing.T) {
+	materialName := fmt.Sprintf("pr-metadata-%s", "123")
+	tmpFile, err := os.CreateTemp("", fmt.Sprintf("%s*.json", materialName))
+	require.NoError(t, err)
+	defer os.Remove(tmpFile.Name())
</file context>