fix(materials): guard legacy tool annotations against empty values

[jiparis]

Summary

• Guard all legacy tool annotation assignments (chainloop.material.tool.name, chainloop.material.tool.version) with non-empty checks across all material crafters (CycloneDX, SPDX, SARIF, CSAF)
• Prevents SBOM uploads from failing when a tool entry has an empty version string

Fixes #2880

[cubic-dev-ai]

2 issues found across 9 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/attestation/crafter/materials/csaf.go">

<violation number="1" location="pkg/attestation/crafter/materials/csaf.go:152">
P2: Add a CSAF test for empty `generator.engine.name` / `version` values; the new guard changes annotation behavior but is not covered.

(Based on your team's feedback about adding or updating tests for new paths.) [FEEDBACK_USED]</violation>
</file>

<file name="pkg/attestation/crafter/materials/spdxjson.go">

<violation number="1" location="pkg/attestation/crafter/materials/spdxjson.go:94">
P3: Add a SPDX JSON craft test case where the first tool has an empty name to exercise the new guard and assert the legacy name annotation is omitted.

(Based on your team's feedback about adding/updating tests for new paths.) [FEEDBACK_USED]</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}