feat(attestation): Make attestation view URL clickable in CI/CD reports (#2677)

migmartri · web-flow · commit de7dfb08ee15 · 2026-01-21T16:19:22.000+01:00
Signed-off-by: Miguel Martinez &lt;miguel@chainloop.dev&gt;
diff --git a/app/cli/cmd/attestation_push.go b/app/cli/cmd/attestation_push.go
@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -120,7 +120,7 @@ func newAttestationPushCmd() *cobra.Command {
 			if !deactivateCIReport && !res.Status.DryRun && res.Status.RunnerContext != nil {
 				// Clean up possible ANSI characters from the output
 				sanitizedOutput := removeAnsiCharactersFromBytes(res.Status.TerminalOutput)
-				if err := res.Status.RunnerContext.RawRunner.Report(sanitizedOutput); err != nil {
+				if err := res.Status.RunnerContext.RawRunner.Report(sanitizedOutput, res.Status.AttestationViewURL); err != nil {
 					logger.Warn().Err(err).Msg("failed to write CI/CD platform report")
 				} else {
 					// Log success message based on runner type
diff --git a/app/cli/pkg/action/action.go b/app/cli/pkg/action/action.go
@@ -176,12 +176,12 @@ func fetchUIDashboardURL(ctx context.Context, cpConnection *grpc.ClientConn) str
 
 // buildAttestationViewURL constructs the attestation view URL
 // Returns empty string if platformURL is not configured
-func buildAttestationViewURL(uiDashboardURL, digest string) string {
+func buildAttestationViewURL(uiDashboardURL, orgName, digest string) string {
 	if uiDashboardURL == "" || digest == "" {
 		return ""
 	}
 
 	// Trim trailing slash from platform URL if present
 	uiDashboardURL = strings.TrimRight(uiDashboardURL, "/")
-	return fmt.Sprintf("%s/attestation/%s?tab=summary", uiDashboardURL, digest)
+	return fmt.Sprintf("%s/u/%s/workflow-runs/%s", uiDashboardURL, orgName, digest)
 }
diff --git a/app/cli/pkg/action/attestation_push.go b/app/cli/pkg/action/attestation_push.go
@@ -227,7 +227,7 @@ func (action *AttestationPush) Run(ctx context.Context, attestationID string, ru
 	}
 
 	// Build attestation view URL
-	attestationResult.Status.AttestationViewURL = buildAttestationViewURL(crafter.CraftingState.UiDashboardUrl, attestationResult.Digest)
+	attestationResult.Status.AttestationViewURL = buildAttestationViewURL(crafter.CraftingState.UiDashboardUrl, workflow.GetOrganization(), attestationResult.Digest)
 
 	action.Logger.Info().Msg("push completed")
 
diff --git a/app/cli/pkg/action/workflow_run_describe.go b/app/cli/pkg/action/workflow_run_describe.go
@@ -232,7 +232,7 @@ func (action *WorkflowRunDescribe) Run(ctx context.Context, opts *WorkflowRunDes
 	var attestationViewURL string
 	baseUIDashboardURL := fetchUIDashboardURL(ctx, action.cfg.CPConnection)
 	if baseUIDashboardURL != "" {
-		attestationViewURL = buildAttestationViewURL(baseUIDashboardURL, att.DigestInCasBackend)
+		attestationViewURL = buildAttestationViewURL(baseUIDashboardURL, resp.GetResult().GetOrgName(), att.DigestInCasBackend)
 	}
 
 	item.Attestation = &WorkflowRunAttestationItem{
diff --git a/app/controlplane/api/controlplane/v1/workflow_run.pb.go b/app/controlplane/api/controlplane/v1/workflow_run.pb.go
diff --git a/app/controlplane/api/controlplane/v1/workflow_run.proto b/app/controlplane/api/controlplane/v1/workflow_run.proto
@@ -244,6 +244,7 @@ message WorkflowRunServiceViewResponse {
   Result result = 1;
 
   message Result {
+    string org_name = 5;
     WorkflowRunItem workflow_run = 1;
     AttestationItem attestation = 2;
     // It will be nil if the verification is not possible (old or non-keyless attestations)
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/workflow_run.ts b/app/controlplane/api/gen/frontend/controlplane/v1/workflow_run.ts
diff --git a/app/controlplane/api/gen/jsonschema/controlplane.v1.WorkflowRunServiceViewResponse.Result.jsonschema.json b/app/controlplane/api/gen/jsonschema/controlplane.v1.WorkflowRunServiceViewResponse.Result.jsonschema.json
diff --git a/app/controlplane/api/gen/jsonschema/controlplane.v1.WorkflowRunServiceViewResponse.Result.schema.json b/app/controlplane/api/gen/jsonschema/controlplane.v1.WorkflowRunServiceViewResponse.Result.schema.json
diff --git a/app/controlplane/internal/service/workflowrun.go b/app/controlplane/internal/service/workflowrun.go
@@ -186,6 +186,7 @@ func (s *WorkflowRunService) View(ctx context.Context, req *pb.WorkflowRunServic
 	wr.ContractVersion = bizWorkFlowContractVersionToPb(contractAndVersion.Version, contractAndVersion.Contract)
 	wr.ContractVersion.ContractName = contractAndVersion.Contract.Name
 	res := &pb.WorkflowRunServiceViewResponse_Result{
+		OrgName:      currentOrg.Name,
 		WorkflowRun:  wr,
 		Attestation:  attestation,
 		Verification: verificationResult,
diff --git a/pkg/attestation/crafter/runner.go b/pkg/attestation/crafter/runner.go
@@ -60,8 +60,9 @@ type SupportedRunner interface {
 	VerifyCommitSignature(ctx context.Context, commitHash string) *commitverification.CommitVerification
 
 	// Report writes attestation table output to platform-specific location.
+	// attestationViewURL is an optional URL to view the attestation details.
 	// Returns nil if platform doesn't support reporting.
-	Report(tableOutput []byte) error
+	Report(tableOutput []byte, attestationViewURL string) error
 }
 
 type RunnerM map[schemaapi.CraftingSchema_Runner_RunnerType]SupportedRunner
diff --git a/pkg/attestation/crafter/runners/azurepipeline.go b/pkg/attestation/crafter/runners/azurepipeline.go
@@ -102,6 +102,6 @@ func (r *AzurePipeline) VerifyCommitSignature(_ context.Context, _ string) *comm
 	return nil // Not supported for this runner
 }
 
-func (r *AzurePipeline) Report(_ []byte) error {
+func (r *AzurePipeline) Report(_ []byte, _ string) error {
 	return nil
 }
diff --git a/pkg/attestation/crafter/runners/circleci_build.go b/pkg/attestation/crafter/runners/circleci_build.go
@@ -82,6 +82,6 @@ func (r *CircleCIBuild) VerifyCommitSignature(_ context.Context, _ string) *comm
 	return nil // Not supported for this runner
 }
 
-func (r *CircleCIBuild) Report(_ []byte) error {
+func (r *CircleCIBuild) Report(_ []byte, _ string) error {
 	return nil
 }
diff --git a/pkg/attestation/crafter/runners/daggerpipeline.go b/pkg/attestation/crafter/runners/daggerpipeline.go
@@ -182,6 +182,6 @@ func (r *DaggerPipeline) verifyCommitViaGitLab(ctx context.Context, commitHash s
 	return commitverification.VerifyGitLabCommit(ctx, baseURL, projectPath, commitHash, token, r.logger)
 }
 
-func (r *DaggerPipeline) Report(_ []byte) error {
+func (r *DaggerPipeline) Report(_ []byte, _ string) error {
 	return nil
 }
diff --git a/pkg/attestation/crafter/runners/generic.go b/pkg/attestation/crafter/runners/generic.go
@@ -66,6 +66,6 @@ func (r *Generic) VerifyCommitSignature(_ context.Context, _ string) *commitveri
 	return nil // Not supported for this runner
 }
 
-func (r *Generic) Report(_ []byte) error {
+func (r *Generic) Report(_ []byte, _ string) error {
 	return nil
 }
diff --git a/pkg/attestation/crafter/runners/githubaction.go b/pkg/attestation/crafter/runners/githubaction.go
@@ -168,18 +168,19 @@ func (r *GitHubAction) VerifyCommitSignature(ctx context.Context, commitHash str
 }
 
 // Report writes attestation table output to GitHub Step Summary
-func (r *GitHubAction) Report(tableOutput []byte) error {
+func (r *GitHubAction) Report(tableOutput []byte, attestationViewURL string) error {
 	summaryFile := os.Getenv("GITHUB_STEP_SUMMARY")
 	if summaryFile == "" {
 		return fmt.Errorf("GITHUB_STEP_SUMMARY environment variable not set")
 	}
 
-	// Wrap table output in markdown code block
-	var content strings.Builder
-	content.WriteString("## Chainloop Attestation Report\n\n")
-	content.WriteString("```\n")
-	content.Write(tableOutput)
-	content.WriteString("```\n")
+	// Build the markdown content
+	content := fmt.Sprintf("## Chainloop Attestation Report\n\n```\n%s```\n", tableOutput)
+
+	// Add clickable markdown link after the table if URL is provided
+	if attestationViewURL != "" {
+		content += fmt.Sprintf("\n[View Attestation Details](%s)\n", attestationViewURL)
+	}
 
 	// Append to GITHUB_STEP_SUMMARY file
 	f, err := os.OpenFile(summaryFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
@@ -188,7 +189,7 @@ func (r *GitHubAction) Report(tableOutput []byte) error {
 	}
 	defer f.Close()
 
-	if _, err := f.WriteString(content.String()); err != nil {
+	if _, err := f.WriteString(content); err != nil {
 		return fmt.Errorf("failed to write to GITHUB_STEP_SUMMARY: %w", err)
 	}
 
diff --git a/pkg/attestation/crafter/runners/gitlabpipeline.go b/pkg/attestation/crafter/runners/gitlabpipeline.go
@@ -141,10 +141,18 @@ func (r *GitlabPipeline) VerifyCommitSignature(ctx context.Context, commitHash s
 }
 
 // Report writes attestation table output as text artifact
-func (r *GitlabPipeline) Report(tableOutput []byte) error {
+func (r *GitlabPipeline) Report(tableOutput []byte, attestationViewURL string) error {
 	artifactFile := "chainloop-attestation-report.txt"
 
-	if err := os.WriteFile(artifactFile, tableOutput, 0600); err != nil {
+	// Build the content with optional clickable link
+	content := fmt.Sprintf("# Chainloop Attestation Report\n\n%s", tableOutput)
+
+	// Add clickable markdown link after the table if URL is provided
+	if attestationViewURL != "" {
+		content += fmt.Sprintf("\n\n[View Attestation Details](%s)\n", attestationViewURL)
+	}
+
+	if err := os.WriteFile(artifactFile, []byte(content), 0600); err != nil {
 		return fmt.Errorf("failed to write attestation report: %w", err)
 	}
 
diff --git a/pkg/attestation/crafter/runners/jenkinsjob.go b/pkg/attestation/crafter/runners/jenkinsjob.go
@@ -89,6 +89,6 @@ func (r *JenkinsJob) VerifyCommitSignature(_ context.Context, _ string) *commitv
 	return nil // Not supported for this runner
 }
 
-func (r *JenkinsJob) Report(_ []byte) error {
+func (r *JenkinsJob) Report(_ []byte, _ string) error {
 	return nil
 }
diff --git a/pkg/attestation/crafter/runners/teamcitypipeline.go b/pkg/attestation/crafter/runners/teamcitypipeline.go
@@ -75,6 +75,6 @@ func (r *TeamCityPipeline) VerifyCommitSignature(_ context.Context, _ string) *c
 	return nil // Not supported for this runner
 }
 
-func (r *TeamCityPipeline) Report(_ []byte) error {
+func (r *TeamCityPipeline) Report(_ []byte, _ string) error {
 	return nil
 }
diff --git a/pkg/attestation/crafter/runners/tektonpipeline.go b/pkg/attestation/crafter/runners/tektonpipeline.go
@@ -71,6 +71,6 @@ func (r *TektonPipeline) VerifyCommitSignature(_ context.Context, _ string) *com
 	return nil // Not supported for this runner
 }
 
-func (r *TektonPipeline) Report(_ []byte) error {
+func (r *TektonPipeline) Report(_ []byte, _ string) error {
 	return nil
 }

Original file line number	Diff line number	Diff line change
`@@ -176,12 +176,12 @@ func fetchUIDashboardURL(ctx context.Context, cpConnection *grpc.ClientConn) str`
`176`	`176`
`177`	`177`	`// buildAttestationViewURL constructs the attestation view URL`
`178`	`178`	`// Returns empty string if platformURL is not configured`
`179`		`-func buildAttestationViewURL(uiDashboardURL, digest string) string {`
	`179`	`+func buildAttestationViewURL(uiDashboardURL, orgName, digest string) string {`
`180`	`180`	`if uiDashboardURL == "" \|\| digest == "" {`
`181`	`181`	`return ""`
`182`	`182`	`}`
`183`	`183`
`184`	`184`	`// Trim trailing slash from platform URL if present`
`185`	`185`	`uiDashboardURL = strings.TrimRight(uiDashboardURL, "/")`
`186`		`- return fmt.Sprintf("%s/attestation/%s?tab=summary", uiDashboardURL, digest)`
	`186`	`+ return fmt.Sprintf("%s/u/%s/workflow-runs/%s", uiDashboardURL, orgName, digest)`
`187`	`187`	`}`
Original file line number	Diff line number	Diff line change
`@@ -227,7 +227,7 @@ func (action *AttestationPush) Run(ctx context.Context, attestationID string, ru`
`227`	`227`	`}`
`228`	`228`
`229`	`229`	`// Build attestation view URL`
`230`		`- attestationResult.Status.AttestationViewURL = buildAttestationViewURL(crafter.CraftingState.UiDashboardUrl, attestationResult.Digest)`
	`230`	`+ attestationResult.Status.AttestationViewURL = buildAttestationViewURL(crafter.CraftingState.UiDashboardUrl, workflow.GetOrganization(), attestationResult.Digest)`
`231`	`231`
`232`	`232`	`action.Logger.Info().Msg("push completed")`
`233`	`233`
Original file line number	Diff line number	Diff line change
`@@ -232,7 +232,7 @@ func (action WorkflowRunDescribe) Run(ctx context.Context, opts WorkflowRunDes`
`232`	`232`	`var attestationViewURL string`
`233`	`233`	`baseUIDashboardURL := fetchUIDashboardURL(ctx, action.cfg.CPConnection)`
`234`	`234`	`if baseUIDashboardURL != "" {`
`235`		`- attestationViewURL = buildAttestationViewURL(baseUIDashboardURL, att.DigestInCasBackend)`
	`235`	`+ attestationViewURL = buildAttestationViewURL(baseUIDashboardURL, resp.GetResult().GetOrgName(), att.DigestInCasBackend)`
`236`	`236`	`}`
`237`	`237`
`238`	`238`	`item.Attestation = &WorkflowRunAttestationItem{`