Uh oh!
There was an error while loading. Please reload this page.
feat(cli): add flags to override policy inputs (replace, not append) - #3338
Merged
Conversation
Add --policy-input for setting a policy input to an inline literal value and --policy-input-from-file-replace for sourcing it from a file, both of which replace the contract-declared value instead of appending to it. This makes it possible to override a scalar policy input at run time, which the existing append-only --policy-input-from-file cannot do; the append flag is unchanged. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev> Chainloop-Trace-Sessions: 8f1220ca-1af0-4865-89f3-9705c9df189c
Contributor
Security Checks — ✅ 2 passingPR info
|
| Scan | Reason |
|---|---|
vulnerability-scan | no manifest/lockfile changed |
github-actions-scan | no workflow files changed |
iac-scan | no IaC files changed |
Powered by Chainloop and Chainloop Trace
There was a problem hiding this comment.
All reported issues were addressed across 11 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
When several runtime-input scopes match one policy attachment and set the same input, apply them most-specific-last (digest-pinned > scheme/org-qualified > bare name, ties by scope string) so the merged value is deterministic regardless of Go map iteration order; this covers both append and replace modes. Also document that an inline --policy-input takes precedence over --policy-input-from-file-replace for the same input. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev> Chainloop-Trace-Sessions: 8f1220ca-1af0-4865-89f3-9705c9df189c
javirln
marked this pull request as ready for review
August 10, 2026 09:29
javirln
enabled auto-merge (squash)
August 10, 2026 09:30
There was a problem hiding this comment.
All reported issues were addressed across 4 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Uh oh!
There was an error while loading. Please reload this page.
scopeSpecificity only bumped for '://' or '/', so a provider-prefixed scope (provider:name) scored the same as a bare name and could lose the lexical tie-break. Treat any ':' or '/' beyond the bare name (scheme, org path or provider prefix) as qualification, while stripping the '@sha256:' digest suffix so its colon does not inflate the score. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev> Chainloop-Trace-Sessions: 8f1220ca-1af0-4865-89f3-9705c9df189c
…replace Add a visible --append boolean reserved for a future release: it warns and has no effect yet, but will later control whether --policy-input and --policy-input-from-file append to rather than replace the contract-declared value. Remove --policy-input-from-file-replace, since that future model makes replace the default for --policy-input-from-file and a dedicated replace flag redundant. Inline scalar override via --policy-input is unchanged. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev> Chainloop-Trace-Sessions: 8f1220ca-1af0-4865-89f3-9705c9df189c
The reserved --append flag stays visible with help text noting it has no effect yet; the per-invocation warning was unnecessary noise and is removed. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev> Chainloop-Trace-Sessions: 8f1220ca-1af0-4865-89f3-9705c9df189c
jiparis
reviewed
Aug 10, 2026
Uh oh!
There was an error while loading. Please reload this page.
Collapse the two filter loops into one range over the append/replace maps and use slices.Sorted(maps.Keys(...)) instead of a manual collect-and-sort loop. The args[k] membership check is kept: ComputeArguments drops runtime keys the policy doesn't declare, so the field must report only overrides that actually applied. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev> Chainloop-Trace-Sessions: 8f1220ca-1af0-4865-89f3-9705c9df189c
jiparis
approved these changes
Aug 10, 2026
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a way to supply a policy input at
chainloop attestation addtime that replaces the contract-declared value, which the existing append-only--policy-input-from-filecannot do.--policy-input [<policy>:]<input>=<value>sets a policy input to an inline literal value that replaces any contract-declared value for that key. This makes it possible to override a scalar policy input at run time (for example loweringmin_iterationsfor a single run) instead of turning it into a multi-value list.--policy-input-from-fileis unchanged: its values are still appended to the contract value.Both support an optional
<policy>:prefix to scope an input to a single policy (matched by name or ref); otherwise the input applies to every declaring policy. When several scopes match the same policy, the most specific one wins deterministically.Also adds
--append, a flag reserved for a future release: it is accepted but has no effect yet, and will later control whether--policy-inputand--policy-input-from-fileappend to rather than replace the contract-declared value.Closes PFM-6906.
AI assistance: this contribution was implemented with Claude Code.