feat: introduce PR mode for attestations

Merged
MI
4mo ago
+247-3

What

Introduces a "PR mode" for attestations that captures and propagates the pull/merge request signal as a top-level annotation on the attestation.

Changes

  • --pr flag on chainloop attestation init: explicitly marks the attestation as a PR/MR build. Auto-detected from the CI runner environment (GitHub Actions GITHUB_EVENT_NAME=pull_request, GitLab CI_PIPELINE_SOURCE=merge_request_event) when not set. --pr=false forces it off.

  • chainloop.dev/is-pull-request=true annotation: set on the attestation when in PR mode, so downstream consumers (e.g. findings processing) can detect PR-originated attestations and skip reprocessing.

  • Skip latest promotion: when in PR mode, mark-latest defaults to false (replacing the manual --mark-latest=false workaround). An explicitly passed --mark-latest=true still wins.

  • Push annotation preservation: the push path now preserves existing attestation-level annotations (like the PR marker) alongside contract and runtime annotations, instead of overwriting them.

Fixes #3265

Assisted-by: Claude Code

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri