feat: add reviewers to PR metadata

[jiparis]

This is a follow up for #2843. Adding reviewers to PR metadata to look for known bots.

• Add a reviewers field to PR/MR metadata collected during attestation, enabling detection of AI agent reviewers (e.g., coderabbitai, cubic-dev-ai, devin-ai-integration) in the software supply chain
• For GitHub, reviewers are parsed from requested_reviewers in the event payload (no API call needed)
• For GitLab, reviewers are fetched from the MR API using CI_JOB_TOKEN (best-effort, graceful degradation)
• Introduces pr-info schema v1.1 with the new reviewers field while preserving v1.0 for backward compatibility

[cubic-dev-ai]

5 issues found across 12 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/attestation/crafter/prmetadata_test.go">

<violation number="1" location="pkg/attestation/crafter/prmetadata_test.go:81">
P2: This test locks the new GitLab `reviewers` field to empty instead of covering the integration path that should populate it, so wiring regressions can slip through.

(Based on your team's feedback about adding or updating tests for new paths.) [FEEDBACK_USED]</violation>
</file>

<file name="pkg/attestation/crafter/materials/chainloop_pr_info_test.go">

<violation number="1" location="pkg/attestation/crafter/materials/chainloop_pr_info_test.go:121">
P2: Keep a v1.0 validation assertion here as well. Replacing the old check with v1.1 removes test coverage for the backward-compatible 1.0 schema path.

(Based on your team's feedback about cross-version compatibility.) [FEEDBACK_USED]</violation>
</file>

<file name="pkg/attestation/crafter/prmetadata.go">

<violation number="1" location="pkg/attestation/crafter/prmetadata.go:167">
P2: Use the merge-request project path here; `CI_PROJECT_PATH` will miss reviewers for fork-based GitLab MRs.</violation>
</file>

<file name="internal/prinfo/prinfo.go">

<violation number="1" location="internal/prinfo/prinfo.go:42">
P2: `omitempty` makes reviewer collection failures indistinguishable from a PR/MR that truly has no reviewers, so downstream policy checks can silently miss unavailable reviewer data.

(Based on your team's feedback about preferring explicit states over omission.) [FEEDBACK_USED]</violation>
</file>

<file name="internal/prinfo/prinfo_test.go">

<violation number="1" location="internal/prinfo/prinfo_test.go:178">
P2: Keep a test path for `PRInfoVersion1_0`; this change drops coverage for the backward-compatible schema the PR says is still supported.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/attestation/crafter/prmetadata.go">

<violation number="1" location="pkg/attestation/crafter/prmetadata.go:168">
P2: Use `envVars` here instead of `os.Getenv`, otherwise reviewer collection can fail in runners that supply CI context via `ResolveEnvVars` rather than the process environment.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[migmartri]

I was actually thinking about this today :)

[cubic-dev-ai]

2 issues found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/attestation/crafter/runners/gitlabpipeline.go">

<violation number="1" location="pkg/attestation/crafter/runners/gitlabpipeline.go:82">
P1: Do not include `CI_JOB_TOKEN` in `ListEnvVars`; it will leak the job token into persisted attestation metadata.</violation>
</file>

<file name="pkg/attestation/crafter/runners/daggerpipeline.go">

<violation number="1" location="pkg/attestation/crafter/runners/daggerpipeline.go:74">
P1: Do not inject `CI_JOB_TOKEN` into attestation metadata; this leaks a live GitLab credential.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}