add exit code 2 on subject resolution error

Author: mnsboev

evidence/cli/flags.go

@@ -73,7 +73,7 @@ var flagsMap = map[string]components.Flag{
 	providerId:         components.NewStringFlag(providerId, "Provider ID for the evidence.", func(f *components.StringFlag) { f.Mandatory = false }),
 	publicKeys:         components.NewStringFlag(publicKeys, "Array of paths to public keys for signatures verification with \";\" separator. Supported keys: 'ecdsa','rsa' and 'ed25519'.", func(f *components.StringFlag) { f.Mandatory = false }),
 	useArtifactoryKeys: components.NewBoolFlag(useArtifactoryKeys, "Use Artifactory keys for verification. When enabled, the verify command retrieves keys from Artifactory.", func(f *components.BoolFlag) { f.DefaultValue = false }),
-	sigstoreBundle:     components.NewStringFlag(sigstoreBundle, "Path to a Sigstore bundle file with a pre-signed DSSE envelope. Incompatible with --"+key+", --"+keyAlias+", --"+predicate+", --"+predicateType+" and --"+subjectSha256+".", func(f *components.StringFlag) { f.Mandatory = false }),
+	sigstoreBundle:     components.NewStringFlag(sigstoreBundle, "Path to a Sigstore bundle file with a pre-signed DSSE envelope. Incompatible with --"+key+", --"+keyAlias+", --"+predicate+", --"+predicateType+" and --"+subjectSha256+". If subject is omitted, it will be extracted from the DSSE when possible. Returns exit code 2 if subject resolution fails.", func(f *components.StringFlag) { f.Mandatory = false }),
 }
 
 var commandFlags = map[string][]string{

evidence/create/create_custom.go

@@ -2,6 +2,7 @@ package create
 
 import (
 	"encoding/json"
+	"github.com/jfrog/jfrog-cli-core/v2/utils/coreutils"
 	clientLog "github.com/jfrog/jfrog-client-go/utils/log"
 	"github.com/sigstore/sigstore-go/pkg/bundle"
 	"regexp"
@@ -15,9 +16,10 @@ import (
 
 type createEvidenceCustom struct {
 	createEvidenceBase
-	subjectRepoPath    string
-	subjectSha256      string
-	sigstoreBundlePath string
+	subjectRepoPath       string
+	subjectSha256         string
+	sigstoreBundlePath    string
+	autoSubjectResolution bool
 }
 
 func NewCreateEvidenceCustom(serverDetails *config.ServerDetails, predicateFilePath, predicateType, markdownFilePath, key, keyId, subjectRepoPath,
@@ -62,13 +64,13 @@ func (c *createEvidenceCustom) Run() error {
 		return err
 	}
 
-	err = validateSubject(c.subjectRepoPath)
+	err = c.validateSubject()
 	if err != nil {
 		return err
 	}
 	err = c.uploadEvidence(evidencePayload, c.subjectRepoPath)
 	if err != nil {
-		err = handleSubjectNotFound(err, c.subjectRepoPath)
+		err = c.handleSubjectNotFound(err)
 		return err
 	}
 
@@ -82,6 +84,7 @@ func (c *createEvidenceCustom) processSigstoreBundle() ([]byte, error) {
 	}
 
 	if c.subjectRepoPath == "" {
+		c.autoSubjectResolution = true
 		extractedSubject, err := c.extractSubjectFromBundle(sigstoreBundle)
 		if err != nil {
 			return nil, err
@@ -99,7 +102,7 @@ func (c *createEvidenceCustom) extractSubjectFromBundle(bundle *bundle.Bundle) (
 	}
 
 	if subject == "" {
-		return "", errorutils.CheckErrorf("Subject is not found in the sigstore bundle. Please ensure the bundle contains a valid subject.")
+		return "", c.newSubjectError("Subject is not found in the sigstore bundle. Please ensure the bundle contains a valid subject.")
 	} else {
 		clientLog.Info("Subject " + subject + " is resolved from sigstore bundle.")
 	}
@@ -116,19 +119,32 @@ func (c *createEvidenceCustom) createDSSEEnvelope() ([]byte, error) {
 	return envelope, nil
 }
 
-func validateSubject(subject string) error {
+func (c *createEvidenceCustom) validateSubject() error {
 	// Pattern: must have at least one slash with non-empty sections
-	if matched, _ := regexp.MatchString(`^[^/]+(/[^/]+)+$`, subject); !matched {
-		return errorutils.CheckErrorf("Subject '%s' is invalid. Subject must be in format: <repo>/<path>/<name> or <repo>/<name>", subject)
+	if matched, _ := regexp.MatchString(`^[^/]+(/[^/]+)+$`, c.subjectRepoPath); !matched {
+		return c.newSubjectError("Subject '" + c.subjectRepoPath + "' is invalid. Subject must be in format: <repo>/<path>/<name> or <repo>/<name>")
 	}
 	return nil
 }
 
-func handleSubjectNotFound(err error, subject string) error {
+func (c *createEvidenceCustom) handleSubjectNotFound(err error) error {
 	errStr := err.Error()
 	if strings.Contains(errStr, "404 Not Found") {
 		clientLog.Debug("Server response error:", err.Error())
-		return errorutils.CheckErrorf("Subject '%s' is not found. Please ensure the subject exists.", subject)
+		return c.newSubjectError("Subject '" + c.subjectRepoPath + "' is not found. Please ensure the subject exists.")
 	}
 	return err
 }
+
+// newSubjectError creates an error with ExitCodeFailNoOp (2) for subject-related failures
+// When auto subject resolution is enabled, this allows pipeline calls with gh attestation
+// sigstore bundle generation to skip command execution without breaking a pipeline
+func (c *createEvidenceCustom) newSubjectError(message string) error {
+	if c.autoSubjectResolution {
+		return coreutils.CliError{
+			ExitCode: coreutils.ExitCodeFailNoOp,
+			ErrorMsg: message,
+		}
+	}
+	return errorutils.CheckErrorf(message)
+}

evidence/create/create_custom_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/jfrog/jfrog-cli-core/v2/utils/config"
+	"github.com/jfrog/jfrog-cli-core/v2/utils/coreutils"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -212,3 +213,112 @@ func TestCreateEvidenceCustom_SigstoreBundleWithSubjectPath(t *testing.T) {
 	assert.Equal(t, bundlePath, custom.sigstoreBundlePath)
 	assert.Equal(t, "provided-repo/provided-artifact", custom.subjectRepoPath)
 }
+
+func TestCreateEvidenceCustom_NewSubjectError_GitHubActions(t *testing.T) {
+	_ = os.Setenv("GITHUB_ACTIONS", "true")
+	defer func() {
+		_ = os.Unsetenv("GITHUB_ACTIONS")
+	}()
+
+	serverDetails := &config.ServerDetails{
+		Url:         "https://test.jfrog.io",
+		User:        "test-user",
+		AccessToken: "test-token",
+	}
+
+	cmd := NewCreateEvidenceCustom(
+		serverDetails,
+		"predicate.json",
+		"https://example.com/predicate/v1",
+		"markdown.md",
+		"key.pem",
+		"key-alias",
+		"test-repo/test-artifact",
+		"abcd1234",
+		"/path/to/sigstore-bundle.json",
+		"test-provider",
+	)
+
+	custom, ok := cmd.(*createEvidenceCustom)
+	assert.True(t, ok, "cmd should be of type *createEvidenceCustom")
+
+	testMessage := "Test error message"
+	err := custom.newSubjectError(testMessage)
+
+	assert.Error(t, err)
+	cliErr, ok := err.(coreutils.CliError)
+	assert.True(t, ok, "error should be of type CliError when running under GitHub Actions with sigstore bundle")
+	assert.Equal(t, coreutils.ExitCodeFailNoOp, cliErr.ExitCode, "should return exit code 2 (ExitCodeFailNoOp)")
+	assert.Equal(t, testMessage, cliErr.ErrorMsg, "error message should match")
+}
+
+func TestCreateEvidenceCustom_NewSubjectError_RegularExecution(t *testing.T) {
+	_ = os.Unsetenv("GITHUB_ACTIONS")
+
+	serverDetails := &config.ServerDetails{
+		Url:         "https://test.jfrog.io",
+		User:        "test-user",
+		AccessToken: "test-token",
+	}
+
+	cmd := NewCreateEvidenceCustom(
+		serverDetails,
+		"predicate.json",
+		"https://example.com/predicate/v1",
+		"markdown.md",
+		"key.pem",
+		"key-alias",
+		"test-repo/test-artifact",
+		"abcd1234",
+		"/path/to/sigstore-bundle.json",
+		"test-provider",
+	)
+
+	custom, ok := cmd.(*createEvidenceCustom)
+	assert.True(t, ok, "cmd should be of type *createEvidenceCustom")
+
+	testMessage := "Test error message"
+	err := custom.newSubjectError(testMessage)
+
+	assert.Error(t, err)
+	_, ok = err.(coreutils.CliError)
+	assert.False(t, ok, "error should not be of type CliError when not running under GitHub Actions")
+	assert.Contains(t, err.Error(), testMessage, "error message should contain the test message")
+}
+
+func TestCreateEvidenceCustom_NewSubjectError_GitHubActionsWithoutSigstoreBundle(t *testing.T) {
+	_ = os.Setenv("GITHUB_ACTIONS", "true")
+	defer func() {
+		_ = os.Unsetenv("GITHUB_ACTIONS")
+	}()
+
+	serverDetails := &config.ServerDetails{
+		Url:         "https://test.jfrog.io",
+		User:        "test-user",
+		AccessToken: "test-token",
+	}
+
+	cmd := NewCreateEvidenceCustom(
+		serverDetails,
+		"predicate.json",
+		"https://example.com/predicate/v1",
+		"markdown.md",
+		"key.pem",
+		"key-alias",
+		"test-repo/test-artifact",
+		"abcd1234",
+		"",
+		"test-provider",
+	)
+
+	custom, ok := cmd.(*createEvidenceCustom)
+	assert.True(t, ok, "cmd should be of type *createEvidenceCustom")
+
+	testMessage := "Test error message"
+	err := custom.newSubjectError(testMessage)
+
+	assert.Error(t, err)
+	_, ok = err.(coreutils.CliError)
+	assert.False(t, ok, "error should not be of type CliError when running under GitHub Actions but without sigstore bundle")
+	assert.Contains(t, err.Error(), testMessage, "error message should contain the test message")
+}