feat(policy): add policy develop eval (#2274)

Signed-off-by: Sylwester Piskozub <[email protected]>

Author: Piskoo

app/cli/cmd/policy_develop.go

@@ -28,6 +28,6 @@ Refer to https://docs.chainloop.dev/guides/custom-policies
 `,
 	}
 
-	cmd.AddCommand(newPolicyDevelopInitCmd(), newPolicyDevelopLintCmd())
+	cmd.AddCommand(newPolicyDevelopInitCmd(), newPolicyDevelopLintCmd(), newPolicyDevelopEvalCmd())
 	return cmd
 }

app/cli/cmd/policy_develop_eval.go

@@ -0,0 +1,107 @@
+//
+// Copyright 2025 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/chainloop-dev/chainloop/app/cli/internal/action"
+	schemaapi "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
+	"github.com/spf13/cobra"
+)
+
+func newPolicyDevelopEvalCmd() *cobra.Command {
+	var (
+		materialPath string
+		kind         string
+		annotations  []string
+		policyPath   string
+		inputs       []string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "eval",
+		Short: "Evaluate policy against provided material",
+		Long: `Perform a full evaluation of the policy against the provided material type.
+The command checks if there is a path in the policy for the specified kind and
+evaluates the policy against the provided material or attestation.`,
+		Example: `  
+  # Evaluate policy against a material file
+  chainloop policy eval --policy policy.yaml --material sbom.json --kind SBOM_CYCLONEDX_JSON --annotation key1=value1,key2=value2 --input key3=value3`,
+		RunE: func(_ *cobra.Command, _ []string) error {
+			opts := &action.PolicyEvalOpts{
+				MaterialPath: materialPath,
+				Kind:         kind,
+				Annotations:  parseKeyValue(annotations),
+				PolicyPath:   policyPath,
+				Inputs:       parseKeyValue(inputs),
+			}
+
+			policyEval, err := action.NewPolicyEval(opts, actionOpts)
+			if err != nil {
+				return fmt.Errorf("failed to initialize policy evaluation: %w", err)
+			}
+
+			result, err := policyEval.Run()
+			if err != nil {
+				return newGracefulError(err)
+			}
+
+			switch {
+			case result.Skipped:
+				logger.Info().Msg("policy evaluation skipped")
+				for _, reason := range result.SkipReasons {
+					logger.Info().Msgf("%s", reason)
+				}
+
+			case len(result.Violations) > 0:
+				for _, violation := range result.Violations {
+					logger.Info().Msgf("- %s", violation)
+				}
+				logger.Info().Msg("policy evaluation failed")
+
+			default:
+				if result.Ignored {
+					logger.Info().Msg("policy was ignored")
+				}
+				logger.Info().Msg("policy evaluation passed")
+			}
+
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVar(&materialPath, "material", "", "path to material or attestation file")
+	cobra.CheckErr(cmd.MarkFlagRequired("material"))
+	cmd.Flags().StringVar(&kind, "kind", "", fmt.Sprintf("kind of the material: %q", schemaapi.ListAvailableMaterialKind()))
+	cmd.Flags().StringSliceVar(&annotations, "annotation", []string{}, "key-value pairs of material annotations (key=value)")
+	cmd.Flags().StringVar(&policyPath, "policy", "", "path to custom policy file")
+	cobra.CheckErr(cmd.MarkFlagRequired("policy"))
+	cmd.Flags().StringSliceVar(&inputs, "input", []string{}, "key-value pairs of policy inputs (key=value)")
+
+	return cmd
+}
+
+func parseKeyValue(raw []string) map[string]string {
+	parsed := make(map[string]string)
+	for _, a := range raw {
+		if key, val, ok := strings.Cut(a, "="); ok {
+			parsed[key] = val
+		}
+	}
+	return parsed
+}

app/cli/documentation/cli-reference.mdx

@@ -2784,6 +2784,55 @@ Options inherited from parent commands
 -y, --yes                       Skip confirmation
 ```
 
+#### chainloop policy develop eval
+
+Evaluate policy against provided material
+
+Synopsis
+
+Perform a full evaluation of the policy against the provided material type.
+The command checks if there is a path in the policy for the specified kind and
+evaluates the policy against the provided material or attestation.
+
+```
+chainloop policy develop eval [flags]
+```
+
+Examples
+
+```
+
+Evaluate policy against a material file
+chainloop policy eval --policy policy.yaml --material sbom.json --kind SBOM_CYCLONEDX_JSON --annotation key1=value1,key2=value2 --input key3=value3
+```
+
+Options
+
+```
+--annotation strings   key-value pairs of material annotations (key=value)
+-h, --help                 help for eval
+--input strings        key-value pairs of policy inputs (key=value)
+--kind string          kind of the material: ["ARTIFACT" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CHAINLOOP_RUNNER_CONTEXT" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENVEX" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "TWISTCLI_SCAN_JSON" "ZAP_DAST_ZIP"]
+--material string      path to material or attestation file
+--policy string        path to custom policy file
+```
+
+Options inherited from parent commands
+
+```
+--artifact-cas string       URL for the Artifacts Content Addressable Storage API ($CHAINLOOP_ARTIFACT_CAS_API) (default "api.cas.chainloop.dev:443")
+--artifact-cas-ca string    CUSTOM CA file for the Artifacts CAS API (optional) ($CHAINLOOP_ARTIFACT_CAS_API_CA)
+-c, --config string             Path to an existing config file (default is $HOME/.config/chainloop/config.toml)
+--control-plane string      URL for the Control Plane API ($CHAINLOOP_CONTROL_PLANE_API) (default "api.cp.chainloop.dev:443")
+--control-plane-ca string   CUSTOM CA file for the Control Plane API (optional) ($CHAINLOOP_CONTROL_PLANE_API_CA)
+--debug                     Enable debug/verbose logging mode
+-i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
+-n, --org string                organization name
+-o, --output string             Output format, valid options are json and table (default "table")
+-t, --token string              API token. NOTE: Alternatively use the env variable CHAINLOOP_TOKEN
+-y, --yes                       Skip confirmation
+```
+
 #### chainloop policy develop help
 
 Help about any command

app/cli/internal/action/policy_develop_eval.go

@@ -0,0 +1,72 @@
+//
+// Copyright 2025 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package action
+
+import (
+	"fmt"
+
+	"github.com/chainloop-dev/chainloop/app/cli/internal/policydevel"
+)
+
+type PolicyEvalOpts struct {
+	MaterialPath string
+	Kind         string
+	Annotations  map[string]string
+	PolicyPath   string
+	Inputs       map[string]string
+}
+
+type PolicyEvalResult struct {
+	Skipped     bool
+	SkipReasons []string
+	Violations  []string
+	Ignored     bool
+}
+
+type PolicyEval struct {
+	*ActionsOpts
+	opts *PolicyEvalOpts
+}
+
+func NewPolicyEval(opts *PolicyEvalOpts, actionOpts *ActionsOpts) (*PolicyEval, error) {
+	return &PolicyEval{
+		ActionsOpts: actionOpts,
+		opts:        opts,
+	}, nil
+}
+
+func (action *PolicyEval) Run() (*PolicyEvalResult, error) {
+	evalOpts := &policydevel.EvalOptions{
+		PolicyPath:   action.opts.PolicyPath,
+		MaterialKind: action.opts.Kind,
+		Annotations:  action.opts.Annotations,
+		MaterialPath: action.opts.MaterialPath,
+		Inputs:       action.opts.Inputs,
+	}
+
+	// Evaluate policy
+	result, err := policydevel.Evaluate(evalOpts, action.Logger)
+	if err != nil {
+		return nil, fmt.Errorf("evaluating policy: %w", err)
+	}
+
+	return &PolicyEvalResult{
+		Ignored:     result.Ignored,
+		Skipped:     result.Skipped,
+		SkipReasons: result.SkipReasons,
+		Violations:  result.Violations,
+	}, nil
+}