refactor: remove the public attribute from workflows

Merged
MA
3mo ago
+336-2027

Summary

Removes the workflow public feature from Chainloop. Public workflows previously made a workflow's runs, attestations, materials and CAS artifacts readable by any authenticated user across organizations. With this change, access to that evidence is organization-scoped only and honors project RBAC.

What changes

  • The public attribute is removed from workflows, including the workflows.public database column.
  • Workflow-run and CAS-mapping lookups are now organization-strict; WorkflowRunService.View always applies project RBAC.
  • The cross-organization public download fallback for CAS artifacts is removed.
  • The public shared referrer index is retired, including the DiscoverPublicShared API and its configuration.
  • The CLI --public flags (workflow create, workflow update, referrer discover) and the Public column in workflow list are removed.
  • The corresponding API fields are removed and their tag numbers reserved; WorkflowItem.public is kept as a deprecated, always-false field for wire compatibility.
  • A database migration drops the public column.

Notes

This is an API and behavior change: existing public workflows become organization-only, the DiscoverPublicShared endpoint is removed, and the CLI --public flags no longer exist.