Repository navigation
feat(schemavalidators): add optional provenance.trace_discover to AI security context schema - #3638
Conversation
…security context schema Record the outcome of the Chainloop graph lookup that resolves fingerprint commits to AI coding sessions, so a reader can tell 'no AI sessions' apart from 'the lookup could not run or was refused'. The counters are required when status is ran and forbidden otherwise. The field is optional, so existing artifacts stay valid and schema_version is unchanged. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: b0681449-64bf-4654-beb8-c933c3cea0b3
PR validation — ✅ 3 passing
AI Session Checks — 🟢 91% · ✅ 0 failing
|
| Status | Attribution | File | Lines |
|---|---|---|---|
| modified | ai | internal/schemavalidators/schemavalidators_test.go |
+96 / -21 |
| modified | ai | internal/schemavalidators/internal_schemas/aisecuritycontext/ai-security-context-0.1.schema.json |
+95 / -0 |
Policies (4)
| Status | Policy | Material | Messages |
|---|---|---|---|
| ✅ Passed | ai-config-ai-agents-allowed |
ai-coding-session-b06814 |
- |
| ✅ Passed | ai-config-no-dangerous-commands |
ai-coding-session-b06814 |
- |
| ✅ Passed | ai-config-no-secrets |
ai-coding-session-b06814 |
- |
| ✅ Passed | ai-config-mcp-servers-allowed |
ai-coding-session-b06814 |
- |
Security Checks — ✅ 6 passing
✅ secret-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
✅ iac-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | iac-misconfiguration |
- |
Scans not applied (2)
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
Security context
✅ Nothing this change touches has a recorded security-fix history.
View in Chainloop ↗ · How this works ↗
Powered by Chainloop and Chainloop Trace
…tisfy goconst Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: b0681449-64bf-4654-beb8-c933c3cea0b3
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 2 files
Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.
View guided diff | Re-trigger cubic
2 participants
Adds an optional
provenance.trace_discoverobject to the AI security context schema (ai-security-context-0.1).The producer of a security context looks up, in the Chainloop graph, the AI coding sessions behind fingerprint commits that declare none in a
Chainloop-Trace-Sessionstrailer. Today the artifact cannot record how that lookup went, so a context whose lookups were all refused looks the same as one for a repository with no AI sessions. BecauseprovenancesetsadditionalProperties: false, the schema has to allow the field before a producer can write it.The new object holds:
status:ran,disabled, orcli_not_found.commits,matched,not_found,denied,failed: non-negative integer counters. They are required whenstatusisranand forbidden otherwise (draft-07if/then/else).The field is optional, so artifacts without it stay valid and
schema_versionis unchanged. Validator tests cover the valid and invalid shapes.This change was produced with AI assistance (Claude Code).
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri using the eng-autopilot skill