Skip to content

fix(workflow): respect contract name from schema v2#2740

Merged
migmartri merged 5 commits intochainloop-dev:mainfrom
Piskoo:pfm-4452
Feb 13, 2026
Merged

fix(workflow): respect contract name from schema v2#2740
migmartri merged 5 commits intochainloop-dev:mainfrom
Piskoo:pfm-4452

Conversation

@Piskoo
Copy link
Collaborator

@Piskoo Piskoo commented Feb 13, 2026

When running attestation init with a contract in schema v2, the contract is now created with the name defined in metadata.name instead of the default one.

piVersion: chainloop.dev/v1
kind: Contract
metadata:
  name: different-name
  description: Contract for CSAF advisories and VEX
spec:
  materials:
    # Refs: https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#45-profile-5-vex
    - type: CSAF_VEX
      name: vex-disclosure
    # Refs: https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#43-profile-3-informational-advisory
    - type: CSAF_INFORMATIONAL_ADVISORY
      name: informational-advisory
    # Refs: https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#44-profile-4-security-advisory
    - type: CSAF_SECURITY_ADVISORY
      name: security-advisory
    # Refs: https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#42-profile-2-security-incident-response
    - type: CSAF_SECURITY_INCIDENT_RESPONSE
      name: security-incident-response
$ chainloop att init --project myproject --workflow respects-name --contract contract.yml
WRN API contacted in insecure mode
WRN User-attended mode detected. This is intended for local testing only. For CI/CD or automated workflows, please use an API token.
This command will run against the organization "myorg"
Please confirm to continue y/N
y
INF Attestation initialized! now you can check its status or add materials to it
┌───────────────────────────┬──────────────────────────────────────┐
│ Initialized At            │ 13 Feb 26 12:13 UTC                  │
├───────────────────────────┼──────────────────────────────────────┤
│ Attestation ID            │ be0c970c-b7cf-4a86-98c7-ef772c3cb590 │
│ Organization              │ myorg                                │
│ Name                      │ respects-name                        │
│ Project                   │ myproject                            │
│ Version                   │ v1.19.1+next (prerelease)            │
│ Contract                  │ different-name (revision 1)          │
│ Policy violation strategy │ ADVISORY                             │
└───────────────────────────┴──────────────────────────────────────┘
┌────────────────────────────────────────────┐
│ Materials                                  │
├──────────┬─────────────────────────────────┤
│ Name     │ informational-advisory          │
│ Type     │ CSAF_INFORMATIONAL_ADVISORY     │
│ Set      │ No                              │
│ Required │ Yes                             │
├──────────┼─────────────────────────────────┤
│ Name     │ security-advisory               │
│ Type     │ CSAF_SECURITY_ADVISORY          │
│ Set      │ No                              │
│ Required │ Yes                             │
├──────────┼─────────────────────────────────┤
│ Name     │ security-incident-response      │
│ Type     │ CSAF_SECURITY_INCIDENT_RESPONSE │
│ Set      │ No                              │
│ Required │ Yes                             │
├──────────┼─────────────────────────────────┤
│ Name     │ vex-disclosure                  │
│ Type     │ CSAF_VEX                        │
│ Set      │ No                              │
│ Required │ Yes                             │
└──────────┴─────────────────────────────────┘

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
@Piskoo Piskoo requested review from jiparis and migmartri February 13, 2026 12:35
@Piskoo Piskoo marked this pull request as ready for review February 13, 2026 12:35
@migmartri migmartri merged commit 46f1bbf into chainloop-dev:main Feb 13, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants