feat(slsa): add RequireAttestation configuration for strict SLSA verification

[leodido]

Summary

Adds support for LEEWAY_SLSA_REQUIRE_ATTESTATION environment variable and --slsa-require-attestation CLI flag to control behavior when SLSA attestations are missing or invalid.

Problem

When attestations from one PR fail verification in another PR (e.g., due to source URI mismatches like refs/pull/11265/merge vs refs/pull/11279/merge), the current behavior downloads artifacts without verification. This creates a security gap where unverified artifacts are used without being re-signed with the correct attestation.

Fixes https://linear.app/ona-team/issue/CLC-2053/mechanism-to-control-behavior-when-slsa-attestations-are-missing-or

Solution

Add RequireAttestation configuration that enables two verification modes:

Permissive Mode (RequireAttestation=false, default)

• Missing/invalid attestation → Download without verification (with warning)
• Provides graceful degradation and backward compatibility
• Useful during migration or when some artifacts lack attestations

Strict Mode (RequireAttestation=true)

• Missing/invalid attestation → Skip download, build locally with correct attestation
• Enables self-healing for cross-PR attestation mismatches
• Auto-enabled when provenance.slsa=true in WORKSPACE.yaml
• Recommended for production environments requiring SLSA L3 compliance

Changes

Configuration (Commit 1)

• Add EnvvarSLSARequireAttestation constant to cmd/root.go and pkg/leeway/workspace.go
• Add --slsa-require-attestation flag to build command
• Update parseSLSAConfig() to read and apply RequireAttestation setting
• Update ApplySLSADefaults() to auto-enable RequireAttestation with SLSA L3
• Enhance documentation in pkg/leeway/cache/types.go
• Update implementation comments in pkg/leeway/cache/remote/s3.go

Note: The actual RequireAttestation logic in downloadWithSLSAVerification() was already implemented; this PR adds the configuration mechanism.

Tests (Commit 2)

• Extend TestBuildCommandFlags with 3 test cases for --slsa-require-attestation flag
• Add TestParseSLSAConfig with 6 test cases for configuration parsing logic
• Tests verify flag parsing, environment variable handling, and CLI flag precedence

Documentation (Commit 3)

• Add "SLSA Cache Verification Modes" section to README.md
• Add LEEWAY_SLSA_REQUIRE_ATTESTATION to CLI help text
• Provide examples for overriding the mode

Usage

Via Environment Variable

export LEEWAY_SLSA_REQUIRE_ATTESTATION=true
leeway build :app

Via CLI Flag

leeway build :app --slsa-require-attestation

Automatic (Workspace Config)

# WORKSPACE.yaml
provenance:
  enabled: true
  slsa: true  # Automatically enables RequireAttestation=true

Testing

All tests pass:

$ go test ./cmd/... ./pkg/leeway/cache/...
PASS
ok      github.com/gitpod-io/leeway/cmd                         0.761s
ok      github.com/gitpod-io/leeway/pkg/leeway/cache/remote    62.909s

Implementation Notes

• Only affects AWS S3 remote cache (GCP/gsutil does not support SLSA verification)
• The RequireAttestation logic is used in one place: S3Cache.downloadWithSLSAVerification() (line 484)
• Existing tests in s3_slsa_test.go and s3_resilience_test.go already verify the behavior