feat: add Yelp detect-secrets baseline as a material type

app/cli/documentation/cli-reference.mdx

@@ -252,7 +252,7 @@ Options
 --annotation strings         additional annotation in the format of key=value
 --attestation-id string      Unique identifier of the in-progress attestation
 -h, --help                       help for add
---kind string                kind of the material to be recorded: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "TWISTCLI_SCAN_JSON" "ZAP_DAST_ZIP"]
+--kind string                kind of the material to be recorded: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
 --name string                name of the material as shown in the contract
 --no-strict-validation       skip strict schema validation for structured materials (SBOM_CYCLONEDX_JSON, OPENAPI_SPEC, ASYNCAPI_SPEC)
 --registry-password string   registry password, ($CHAINLOOP_REGISTRY_PASSWORD)
@@ -3025,7 +3025,7 @@ Options
 --annotation strings          Key-value pairs of material annotations (key=value)
 -h, --help                        help for eval
 --input stringArray           Key-value pairs of policy inputs (key=value)
---kind string                 Kind of the material: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "TWISTCLI_SCAN_JSON" "ZAP_DAST_ZIP"]
+--kind string                 Kind of the material: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
 --material string             Path to material or attestation file
 -p, --policy string               Policy reference (./my-policy.yaml, https://my-domain.com/my-policy.yaml, chainloop://my-stored-policy) (default "policy.yaml")
 --project string              Project name to use as engine context for chainloop.* built-ins

app/controlplane/api/workflowcontract/v1/crafting_schema.proto

@@ -163,6 +163,8 @@ message CraftingSchema {
       // GraphQL SDL schema
       // https://spec.graphql.org/
       GRAPHQL_SPEC = 32;
+      // detect-secrets baseline file https://github.com/Yelp/detect-secrets
+      YELP_DETECT_SECRETS_BASELINE = 33;
     }
   }
 }

app/controlplane/api/workflowcontract/v1/crafting_schema_validations.go

@@ -40,6 +40,7 @@ var CraftingMaterialInValidationOrder = []CraftingSchema_Material_MaterialType{
 	CraftingSchema_Material_CSAF_SECURITY_INCIDENT_RESPONSE,
 	CraftingSchema_Material_GITLAB_SECURITY_REPORT,
 	CraftingSchema_Material_GITLEAKS_JSON,
+	CraftingSchema_Material_YELP_DETECT_SECRETS_BASELINE,
 	CraftingSchema_Material_OPENAPI_SPEC,
 	CraftingSchema_Material_ASYNCAPI_SPEC,
 	CraftingSchema_Material_GRAPHQL_SPEC,

pkg/attestation/crafter/materials/detect_secrets.go

@@ -0,0 +1,92 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package materials
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+
+	schemaapi "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
+	api "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
+	"github.com/chainloop-dev/chainloop/pkg/casclient"
+	"github.com/rs/zerolog"
+)
+
+type DetectSecretsCrafter struct {
+	*crafterCommon
+	backend *casclient.CASBackend
+}
+
+// detectSecretsBaseline represents the subset of the detect-secrets baseline
+// file used to validate its structure and extract metadata.
+// https://github.com/Yelp/detect-secrets
+type detectSecretsBaseline struct {
+	Version     string                      `json:"version"`
+	PluginsUsed []map[string]any            `json:"plugins_used"`
+	Results     map[string][]map[string]any `json:"results"`
+}
+
+func NewDetectSecretsCrafter(schema *schemaapi.CraftingSchema_Material, backend *casclient.CASBackend, l *zerolog.Logger) (*DetectSecretsCrafter, error) {
+	if schema.Type != schemaapi.CraftingSchema_Material_YELP_DETECT_SECRETS_BASELINE {
+		return nil, fmt.Errorf("material type is not a detect-secrets baseline")
+	}
+	craftCommon := &crafterCommon{logger: l, input: schema}
+	return &DetectSecretsCrafter{backend: backend, crafterCommon: craftCommon}, nil
+}
+
+func (i *DetectSecretsCrafter) Craft(ctx context.Context, filePath string) (*api.Attestation_Material, error) {
+	data, err := os.ReadFile(filePath)
+	if err != nil {
+		return nil, fmt.Errorf("can't open the file: %w", err)
+	}
+
+	var baseline detectSecretsBaseline
+	if err = json.Unmarshal(data, &baseline); err != nil {
+		return nil, fmt.Errorf("invalid detect-secrets baseline file: %w", ErrInvalidMaterialType)
+	}
+
+	// Structural fingerprint check. A detect-secrets baseline always carries a
+	// version, the list of plugins it ran, and a results map (which may be empty
+	// when no secrets were found). Reject anything missing these fields.
+	if baseline.Version == "" || baseline.PluginsUsed == nil || baseline.Results == nil {
+		return nil, fmt.Errorf("missing required detect-secrets baseline fields: %w", ErrInvalidMaterialType)
+	}
+
+	// An empty results map means a clean scan. It's ambiguous, but we accept it.
+	if len(baseline.Results) == 0 {
+		i.logger.Debug().Msg("Accepting an empty report.")
+	}
+
+	// Call uploadAndCraft with the path of the JSON baseline file
+	m, err := uploadAndCraft(ctx, i.input, i.backend, filePath, i.logger)
+	if err != nil {
+		return nil, err
+	}
+
+	i.injectAnnotations(m, &baseline)
+
+	return m, nil
+}
+
+func (i *DetectSecretsCrafter) injectAnnotations(m *api.Attestation_Material, baseline *detectSecretsBaseline) {
+	if m.Annotations == nil {
+		m.Annotations = make(map[string]string)
+	}
+	m.Annotations[AnnotationToolNameKey] = "detect-secrets"
+	m.Annotations[AnnotationToolVersionKey] = baseline.Version
+}