feat: standardize to chainloop.dev/v1 apiVersion for policies and policy groups

app/cli/internal/policydevel/templates/example-policy.yaml

@@ -2,7 +2,7 @@
 #
 # For policy examples and reference:
 # https://github.com/chainloop-dev/chainloop/tree/main/docs/examples/policies
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: {{.Name | sanitize}}

app/cli/internal/policydevel/testdata/embedded-policy.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: test-policy

app/cli/internal/policydevel/testdata/policy-test.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: policy-test

app/cli/internal/policydevel/testdata/policy.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: test-policy

app/cli/internal/policydevel/testdata/sbom-metadata-component-policy.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: sbom-metadata-component

app/cli/internal/policydevel/testdata/sbom-min-components-policy.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: sbom-min-components

app/cli/internal/policydevel/testdata/sbom-multiple-checks-policy.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: sbom-multiple-checks

app/cli/internal/policydevel/testdata/sbom-valid-cyclonedx-policy.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: sbom-valid-cyclonedx

app/cli/pkg/action/testdata/policy_group.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: PolicyGroup
 metadata:
   name: sbom-quality

app/cli/pkg/action/testdata/policy_group_no_name.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: PolicyGroup
 metadata:
   name: sbom-quality

app/cli/pkg/action/testdata/policy_group_with_arguments.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: PolicyGroup
 metadata:
   name: sbom-quality

app/controlplane/api/workflowcontract/v1/crafting_schema.proto

@@ -252,7 +252,12 @@ message PolicyAttachment {
 
 // Represents a policy to be applied to a material or attestation
 message Policy {
-  string api_version = 1 [(buf.validate.field).string.const = "workflowcontract.chainloop.dev/v1"];
+  string api_version = 1 [(buf.validate.field).string = {
+    in: [
+      "chainloop.dev/v1",
+      "workflowcontract.chainloop.dev/v1"
+    ]
+  }];
   string kind = 2 [(buf.validate.field).string.const = "Policy"];
 
   Metadata metadata = 3 [(buf.validate.field).required = true];
@@ -388,7 +393,12 @@ message PolicyGroupAttachment {
 
 // Represents a group or policies
 message PolicyGroup {
-  string api_version = 1 [(buf.validate.field).string.const = "workflowcontract.chainloop.dev/v1"];
+  string api_version = 1 [(buf.validate.field).string = {
+    in: [
+      "chainloop.dev/v1",
+      "workflowcontract.chainloop.dev/v1"
+    ]
+  }];
   string kind = 2 [(buf.validate.field).string.const = "PolicyGroup"];
 
   Metadata metadata = 3 [(buf.validate.field).required = true];

app/controlplane/api/workflowcontract/v1/policy_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2023 The Chainloop Authors.
+// Copyright 2023-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -13,8 +13,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// limitations under the License.
-
 package v1_test
 
 import (
@@ -77,11 +75,17 @@ func TestValidatePolicy(t *testing.T) {
 			violation: "spec source or policies",
 		},
 		{
-			desc: "correct spec",
+			desc: "correct spec with legacy api version",
 			policy: &v1.Policy{ApiVersion: "workflowcontract.chainloop.dev/v1", Kind: "Policy",
 				Metadata: &v1.Metadata{Name: "my-policy"}, Spec: &v1.PolicySpec{Source: &v1.PolicySpec_Path{Path: "policy.rego"}}},
 			wantErr: false,
 		},
+		{
+			desc: "correct spec with new api version",
+			policy: &v1.Policy{ApiVersion: "chainloop.dev/v1", Kind: "Policy",
+				Metadata: &v1.Metadata{Name: "my-policy"}, Spec: &v1.PolicySpec{Source: &v1.PolicySpec_Path{Path: "policy.rego"}}},
+			wantErr: false,
+		},
 		{
 			desc: "filter material type",
 			policy: &v1.Policy{ApiVersion: "workflowcontract.chainloop.dev/v1", Kind: "Policy",
@@ -116,3 +120,72 @@ func TestValidatePolicy(t *testing.T) {
 		})
 	}
 }
+
+func TestValidatePolicyGroup(t *testing.T) {
+	testCases := []struct {
+		desc      string
+		group     *v1.PolicyGroup
+		wantErr   bool
+		violation string
+	}{
+		{
+			desc:      "empty policy group",
+			group:     &v1.PolicyGroup{},
+			wantErr:   true,
+			violation: "api_version",
+		},
+		{
+			desc:      "wrong api version",
+			group:     &v1.PolicyGroup{ApiVersion: "wrong", Kind: "PolicyGroup"},
+			wantErr:   true,
+			violation: "api_version",
+		},
+		{
+			desc:    "legacy api version accepted",
+			group:   &v1.PolicyGroup{ApiVersion: "workflowcontract.chainloop.dev/v1", Kind: "PolicyGroup", Metadata: &v1.Metadata{Name: "my-group"}, Spec: &v1.PolicyGroup_PolicyGroupSpec{Policies: &v1.PolicyGroup_PolicyGroupPolicies{}}},
+			wantErr: false,
+		},
+		{
+			desc:    "new api version accepted",
+			group:   &v1.PolicyGroup{ApiVersion: "chainloop.dev/v1", Kind: "PolicyGroup", Metadata: &v1.Metadata{Name: "my-group"}, Spec: &v1.PolicyGroup_PolicyGroupSpec{Policies: &v1.PolicyGroup_PolicyGroupPolicies{}}},
+			wantErr: false,
+		},
+		{
+			desc:      "wrong kind",
+			group:     &v1.PolicyGroup{ApiVersion: "chainloop.dev/v1", Kind: "wrong"},
+			wantErr:   true,
+			violation: "kind",
+		},
+		{
+			desc:      "missing metadata",
+			group:     &v1.PolicyGroup{ApiVersion: "chainloop.dev/v1", Kind: "PolicyGroup"},
+			wantErr:   true,
+			violation: "metadata",
+		},
+		{
+			desc:      "missing spec",
+			group:     &v1.PolicyGroup{ApiVersion: "chainloop.dev/v1", Kind: "PolicyGroup", Metadata: &v1.Metadata{Name: "my-group"}},
+			wantErr:   true,
+			violation: "spec",
+		},
+	}
+
+	validator, err := protovalidate.New()
+	require.NoError(t, err)
+
+	for _, tc := range testCases {
+		t.Run(tc.desc, func(t *testing.T) {
+			err := validator.Validate(tc.group)
+			if tc.wantErr {
+				assert.Error(t, err)
+
+				if tc.violation != "" {
+					assert.Contains(t, err.Error(), tc.violation)
+				}
+				return
+			}
+
+			assert.NoError(t, err)
+		})
+	}
+}

app/controlplane/pkg/biz/testdata/policy_group_with_embedded.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: PolicyGroup
 metadata:
   name: test-policy-group

docs/examples/policies/chainloop-commit.yaml

@@ -1,4 +1,4 @@
-# Copyright 2024-2025 The Chainloop Authors.
+# Copyright 2024-2026 The Chainloop Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: chainloop-commit

docs/examples/policies/chainloop-qa.yaml

@@ -1,4 +1,4 @@
-# Copyright 2024-2025 The Chainloop Authors.
+# Copyright 2024-2026 The Chainloop Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,7 +15,7 @@
 # Checks that there are is a container material with a custom annotation "chainloop-qa-approval=true"
 # chainloop att push
 # This can be used as a control gate to allow e.g. a production deployment
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: sarif-errors

docs/examples/policies/http-hostname-validation/policy.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: http-hostname-validation

docs/examples/policies/json-field-validator/policy.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: json-field-validator

docs/examples/policies/quickstart/cdx-fresh.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: cdx-fresh

docs/examples/policies/sarif-errors.yaml

@@ -1,4 +1,4 @@
-# Copyright 2024-2025 The Chainloop Authors.
+# Copyright 2024-2026 The Chainloop Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # Checks that there are no errors in the SARIF report
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: sarif-errors

docs/examples/policies/sbom-freshness/policy.yaml

@@ -1,4 +1,4 @@
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: sbom-freshness

docs/examples/policies/sbom/cyclonedx-banned-licenses.yaml

@@ -1,4 +1,4 @@
-# Copyright 2024 The Chainloop Authors.
+# Copyright 2024-2026 The Chainloop Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-apiVersion: workflowcontract.chainloop.dev/v1
+apiVersion: chainloop.dev/v1
 kind: Policy
 metadata:
   name: cyclonedx-banned-licenses