feat(materials): add TruffleHog and Cobertura material types

Merged
JA
3mo ago
+1313-23

What

Add two native material types to the attestation crafter so their evidence can be attested and policy-evaluated:

  • TRUFFLEHOG_JSON — TruffleHog secret-scan output (JSONL). Projected to policy input as a findings list so secret-detection policies can evaluate it. A clean scan (no secrets, zero-byte output) is crafted as a canonical empty report, so a passing scan stays attestable and projects to an empty findings list.
  • COBERTURA_XML — Cobertura code-coverage reports. Projected to policy input; a non-finite line-rate (an empty report's 0/0) is serialized as null so an empty report stays evaluable and remains distinguishable from genuine 0% coverage.

Both follow the existing crafter pattern: proto enum, crafter and parser, dispatch in Craft, policy-input projection in ingestMaterialToJSON, and auto-detection ordering (Cobertura only; TruffleHog is intentionally excluded from auto-detection since JSONL validation is weak).

AI disclosure

AI assisted in producing this contribution (Claude Code). Each commit carries an Assisted-by: Claude Code trailer.