fix(cli): surface policy-group materials during attestation
Summary
Fixes #3222.
Materials declared by a policy group attached to a contract were not surfaced during attestation for V2 contracts. The CLI enriched the contract's expected-materials list only on the V1 schema, but the crafter stores the V2 schema when it is present, so the enriched V1 was discarded and the policy-group materials never appeared in attestation status/add (nor were they validated as expected).
This change enriches the schema that the crafter actually stores — the V2 schema when present, V1 otherwise — so policy-group materials are merged into the expected-materials list alongside the contract's own materials.
It also clarifies the duplicate-material handling: when the same material is declared in both the contract and an attached policy group, the definitions are now merged silently when compatible, and a clearer warning is emitted only when the material types genuinely conflict.
Tested locally, below is an example of a material called sbom that comes from the policy group
hainloop attestation init --project policygrouptest --workflow test --replace
WRN User-attended mode detected. This is intended for local testing only. For CI/CD or automated workflows, please use an API token.
This command will run against the organization "miguel-test"
Please confirm to continue y/N
y
INF Attestation initialized! now you can check its status or add materials to it
┌───────────────────────────┬────────────────────────────────────────┐
│ Initialized At │ 18 Jun 26 14:43 UTC │
├───────────────────────────┼────────────────────────────────────────┤
│ Attestation ID │ 918bf69a-6365-480a-a798-f06fd9586e37 │
│ Organization │ miguel-test │
│ Name │ test │
│ Project │ policygrouptest │
│ Version │ v1.100.11+next (prerelease) │
│ Contract │ contract-fix-policy-group (revision 1) │
│ Timestamp Authority │ http://timestamp.digicert.com │
│ Policy violation strategy │ ADVISORY │
│ Policies │ ------ │
│ │ sbom-present: missing SBOM material │
└───────────────────────────┴────────────────────────────────────────┘
┌────────────────────────────────┐
│ Materials │
├──────────┬─────────────────────┤
│ Name │ sbom │
│ Type │ SBOM_CYCLONEDX_JSON │
│ Set │ No │
│ Required │ Yes │
└──────────┴─────────────────────┘
in previous versions of the CLI the material was not present nor enforced
AI disclosure
This change was produced with the assistance of Claude Code. Affected commits carry an Assisted-by: Claude Code trailer.
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri