Skip to content

Conversation

@javirln
Copy link
Member

@javirln javirln commented Jan 14, 2026

This PR adds automatic attestation report generation for GitHub Actions and GitLab CI platforms.

Changes

Runner Interface Extension

Extended the SupportedRunner interface with a Report(tableOutput []byte) error method. This method is called by the CLI command layer after successful attestation push to write formatted attestation status to platform-specific locations.

Platform Implementations

  • GitHub Actions: Writes attestation table to $GITHUB_STEP_SUMMARY wrapped in a markdown code block, making it visible in the job summary UI
  • GitLab CI: Writes attestation table to chainloop-attestation-report.txt as a downloadable artifact with instructions on how to access it
  • Other runners: No-op implementation (returns nil)

CLI Integration

The attestation push command now automatically reports attestation status to the CI/CD platform after successful push. The runner instance is accessed via AttestationResultRunnerContext.RawRunner and the report is rendered using existing table formatting functions from the cmd layer.

Opt-out Support

Added --deactivate-ci-report flag to disable automatic reporting when needed.

Error Handling

Report failures are logged as warnings but do not fail the attestation push operation.

Examples

GitHub
Screenshot 2026-01-14 at 18 32 53
GitLab
Screenshot 2026-01-14 at 18 33 29
Screenshot 2026-01-14 at 18 33 48
Screenshot 2026-01-14 at 18 34 07

Ref: #2667

… and GitLab reports

Signed-off-by: Javier Rodriguez <javier@chainloop.dev>
@javirln javirln requested review from jiparis and migmartri January 14, 2026 17:35
@javirln javirln self-assigned this Jan 14, 2026
Comment on lines +129 to +135
var blockingText string
if status.MustBlockOnPolicyViolations {
blockingColor = text.FgHiYellow
blockingText = action.PolicyViolationBlockingStrategyEnforced
blockingText = text.FgHiYellow.Sprint(action.PolicyViolationBlockingStrategyEnforced)
} else {
blockingText = action.PolicyViolationBlockingStrategyAdvisory
}
gt.AppendRow(table.Row{"Policy violation strategy", blockingColor.Sprint(blockingText)})
gt.AppendRow(table.Row{"Policy violation strategy", blockingText})
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not adding a color by default was causing the output to look likes this:

│ Timestamp Authority       │ http://timestamp.digicert.com                                           │
│ Policy violation strategy │ �[0mADVISORY�[0m                                                                │
└───────────────────────────┴─────────────────────────────────────────────────────────────────────────┘
┌───────────────────────────────────────────────────────────────────────────────┐
│ Runner context                                                                │
├─────────────────────────┬─────────────────────────────────────────────────────┤

Signed-off-by: Javier Rodriguez <javier@chainloop.dev>
Signed-off-by: Javier Rodriguez <javier@chainloop.dev>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant