feat: expose policy evaluation info through API (#1770)

Signed-off-by: Miguel Martinez <[email protected]>

Author: migmartri

app/cli/cmd/workflow_workflow_run_describe.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -157,6 +157,12 @@ func workflowRunDescribeTableOutput(run *action.WorkflowRunItemFull) error {
 		}
 	}
 
+	gt.AppendRow(table.Row{"Policies violation strategy", att.PolicyEvaluationStatus.Strategy})
+	if att.PolicyEvaluationStatus.Strategy == action.PolicyViolationBlockingStrategyEnforced {
+		gt.AppendRow(table.Row{"Run Blocked", att.PolicyEvaluationStatus.Blocked})
+		gt.AppendRow(table.Row{"Policy enforcement bypassed", att.PolicyEvaluationStatus.Bypassed})
+	}
+
 	evs := att.PolicyEvaluations[chainloop.AttPolicyEvaluation]
 	if len(evs) > 0 {
 		gt.AppendRow(table.Row{"Policies", "------"})

app/cli/internal/action/workflow_run_describe.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -57,6 +57,15 @@ type WorkflowRunAttestationItem struct {
 	Digest string `json:"digest"`
 	// Policy violations
 	PolicyEvaluations map[string][]*PolicyEvaluation `json:"policy_evaluations,omitempty"`
+	// Policy evaluation status
+	PolicyEvaluationStatus *PolicyEvaluationStatus `json:"policy_evaluation_status,omitempty"`
+}
+
+type PolicyEvaluationStatus struct {
+	Strategy      string `json:"strategy"`
+	Bypassed      bool   `json:"bypassed"`
+	Blocked       bool   `json:"blocked"`
+	HasViolations bool   `json:"has_violations"`
 }
 
 type Material struct {
@@ -204,6 +213,8 @@ func (action *WorkflowRunDescribe) Run(ctx context.Context, opts *WorkflowRunDes
 		evaluations[k] = evs
 	}
 
+	policyEvaluationStatus := attestation.GetPolicyEvaluationStatus()
+
 	item.Attestation = &WorkflowRunAttestationItem{
 		Envelope:          envelope,
 		statement:         statement,
@@ -212,6 +223,12 @@ func (action *WorkflowRunDescribe) Run(ctx context.Context, opts *WorkflowRunDes
 		Annotations:       annotations,
 		Digest:            attestation.DigestInCasBackend,
 		PolicyEvaluations: evaluations,
+		PolicyEvaluationStatus: &PolicyEvaluationStatus{
+			Strategy:      policyEvaluationStatus.Strategy,
+			Bypassed:      policyEvaluationStatus.Bypassed,
+			Blocked:       policyEvaluationStatus.Blocked,
+			HasViolations: policyEvaluationStatus.HasViolations,
+		},
 	}
 
 	return item, nil

app/controlplane/api/controlplane/v1/response_messages.pb.go

@@ -96,6 +96,14 @@ message AttestationItem {
   repeated Material materials = 5;
   map<string, string> annotations = 6;
   map<string, PolicyEvaluations> policy_evaluations = 8;
+  PolicyEvaluationStatus policy_evaluation_status = 9;
+
+  message PolicyEvaluationStatus {
+    string strategy = 1;
+    bool bypassed = 2;
+    bool blocked = 3;
+    bool has_violations = 4;
+  }
 
   message EnvVariable {
     string name = 1;

app/controlplane/api/controlplane/v1/response_messages.proto

@@ -433,13 +433,21 @@ func bizAttestationToPb(att *biz.Attestation) (*cpAPI.AttestationItem, error) {
 		return nil, fmt.Errorf("error extracting materials from attestation: %w", err)
 	}
 
+	policyEvaluationStatus := predicate.GetPolicyEvaluationStatus()
+
 	return &cpAPI.AttestationItem{
 		Envelope:           encodedAttestation,
 		EnvVars:            extractEnvVariables(predicate.GetEnvVars()),
 		DigestInCasBackend: att.Digest,
 		Materials:          materials,
 		Annotations:        predicate.GetAnnotations(),
 		PolicyEvaluations:  extractPolicyEvaluations(predicate.GetPolicyEvaluations()),
+		PolicyEvaluationStatus: &cpAPI.AttestationItem_PolicyEvaluationStatus{
+			Strategy:      string(policyEvaluationStatus.Strategy),
+			Bypassed:      policyEvaluationStatus.Bypassed,
+			Blocked:       policyEvaluationStatus.Blocked,
+			HasViolations: policyEvaluationStatus.HasViolations,
+		},
 	}, nil
 }