feat(cli): add flags to override policy inputs (replace, not append)

app/cli/cmd/attestation_add.go

@@ -42,6 +42,8 @@ func newAttestationAddCmd() *cobra.Command {
 	var annotationsFlag []string
 	var noStrictValidation bool
 	var policyInputFromFileFlag []string
+	var policyInputFlag []string
+	var appendFlag bool
 	var maxExtractEntries int
 	var maxExtractSize string
 
@@ -81,7 +83,12 @@ func newAttestationAddCmd() *cobra.Command {
  # Scope an input to a specific policy with a <policy>: prefix so it only applies to that policy attachment.
  chainloop attestation add --name sigcheck --value sigcheckResult.csv --kind SYSINTERNALS_SIGCHECK \
  --policy-input-from-file trusted-binaries-signed:ignored_paths=exception.csv:Path \
- --policy-input-from-file trusted-binaries-vendor-keys:third_party_paths=exception.csv:Path`,
+ --policy-input-from-file trusted-binaries-vendor-keys:third_party_paths=exception.csv:Path
+
+ # Override a scalar policy input for a single run with an inline literal value. Unlike --policy-input-from-file
+ # (which appends), --policy-input REPLACES the contract-declared value, so a scalar input stays a scalar.
+ chainloop attestation add --name fuzz --value report.txt --kind RADAMSA_REPORT \
+ --policy-input radamsa-min-iterations:min_iterations=10`,
  RunE: func(cmd *cobra.Command, _ []string) error {
  maxExtractSizeBytes, err := bytefmt.ToBytes(maxExtractSize)
  if err != nil {
@@ -125,6 +132,12 @@ func newAttestationAddCmd() *cobra.Command {
  return err
  }
 
+ // Parse the inline --policy-input override values (no file to resolve).
+ policyInputs, err := parsePolicyInputs(policyInputFlag)
+ if err != nil {
+ return err
+ }
+
  // In some cases, the attestation state is stored remotely. To control concurrency we use
  // optimistic locking. We retry the operation if the state has changed since we last read it.
  return runWithBackoffRetry(
@@ -143,7 +156,7 @@ func newAttestationAddCmd() *cobra.Command {
  return fmt.Errorf("loading resource: %w", err)
  }
  }
- resp, err := a.Run(cmd.Context(), attestationID, name, rawValuePath, kind, annotations, policyInputFiles)
+ resp, err := a.Run(cmd.Context(), attestationID, name, rawValuePath, kind, annotations, policyInputFiles, policyInputs)
  if err != nil {
  return err
  }
@@ -187,7 +200,9 @@ func newAttestationAddCmd() *cobra.Command {
 	flagAttestationID(cmd)
 	cmd.Flags().StringVar(&kind, "kind", "", fmt.Sprintf("kind of the material to be recorded: %q", schemaapi.ListAvailableMaterialKind()))
 	cmd.Flags().BoolVar(&noStrictValidation, "no-strict-validation", false, "skip strict schema validation for structured materials (SBOM_CYCLONEDX_JSON, OPENAPI_SPEC, ASYNCAPI_SPEC, OSSF_SCORECARD_JSON)")
-	cmd.Flags().StringArrayVar(&policyInputFromFileFlag, "policy-input-from-file", nil, "feed a policy input from a column of a CSV or JSON file, in the format [<policy>:]<input>=<file>[:<column>] (e.g. ignored_paths=exception.csv:Path); an optional <policy>: prefix scopes the input to a single policy (matched by name or ref), otherwise it applies to every declaring policy; <column> is a single top-level column/field name and defaults to the input name; repeatable. The file is also recorded as EVIDENCE.")
+	cmd.Flags().StringArrayVar(&policyInputFromFileFlag, "policy-input-from-file", nil, "feed a policy input from a column of a CSV or JSON file, in the format [<policy>:]<input>=<file>[:<column>] (e.g. ignored_paths=exception.csv:Path); the values are APPENDED to any contract-declared value; an optional <policy>: prefix scopes the input to a single policy (matched by name or ref), otherwise it applies to every declaring policy; <column> is a single top-level column/field name and defaults to the input name; repeatable. The file is also recorded as EVIDENCE.")
+	cmd.Flags().StringArrayVar(&policyInputFlag, "policy-input", nil, "set a policy input to a literal value that REPLACES (overrides) any contract-declared value for the input, in the format [<policy>:]<input>=<value> (e.g. min_iterations=10); use this to override a scalar input at run time; an optional <policy>: prefix scopes it to a single policy (matched by name or ref), otherwise it applies to every declaring policy; repeatable.")
+	cmd.Flags().BoolVar(&appendFlag, "append", false, "reserved for a future release: will control whether --policy-input and --policy-input-from-file append to (rather than replace) the contract-declared value; has no effect yet")
 
 	// Optional OCI registry credentials
 	cmd.Flags().StringVar(&registryServer, "registry-server", "", fmt.Sprintf("OCI repository server, ($%s)", registryServerEnvVarName))
@@ -245,6 +260,25 @@ func resolvePolicyInputFiles(raw []string) ([]*action.PolicyInputFromFile, error
 	return result, nil
 }
 
+// parsePolicyInputs parses each --policy-input value into an inline override.
+// Unlike the file variants there is no file reference to resolve.
+func parsePolicyInputs(raw []string) ([]*action.PolicyInput, error) {
+	if len(raw) == 0 {
+ return nil, nil
+	}
+
+	result := make([]*action.PolicyInput, 0, len(raw))
+	for _, r := range raw {
+ pi, err := action.ParsePolicyInput(r)
+ if err != nil {
+ return nil, err
+ }
+ result = append(result, pi)
+	}
+
+	return result, nil
+}
+
 // displayMaterialInfo prints the material information in a table format.
 func displayMaterialInfo(status *action.AttestationStatusMaterial, policyEvaluations []*action.PolicyEvaluation) error {
 	if status == nil {

app/cli/documentation/cli-reference.mdx

@@ -254,20 +254,27 @@ Scope an input to a specific policy with a <policy>: prefix so it only applies t
 chainloop attestation add --name sigcheck --value sigcheckResult.csv --kind SYSINTERNALS_SIGCHECK \
 --policy-input-from-file trusted-binaries-signed:ignored_paths=exception.csv:Path \
 --policy-input-from-file trusted-binaries-vendor-keys:third_party_paths=exception.csv:Path
+
+Override a scalar policy input for a single run with an inline literal value. Unlike --policy-input-from-file
+(which appends), --policy-input REPLACES the contract-declared value, so a scalar input stays a scalar.
+chainloop attestation add --name fuzz --value report.txt --kind RADAMSA_REPORT \
+--policy-input radamsa-min-iterations:min_iterations=10
 ```
 
 Options
 
 ```
 --annotation strings additional annotation in the format of key=value
+--append reserved for a future release: will control whether --policy-input and --policy-input-from-file append to (rather than replace) the contract-declared value; has no effect yet
 --attestation-id string Unique identifier of the in-progress attestation
 -h, --help help for add
 --kind string kind of the material to be recorded: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CERTCC_DRANZER" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CHECKMARX_JSON" "COBERTURA_XML" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "OSSF_SCORECARD_JSON" "RADAMSA_CRASHES" "RADAMSA_REPORT" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "SYSINTERNALS_ACCESSCHK" "SYSINTERNALS_SIGCHECK" "TRUFFLEHOG_JSON" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
 --max-extract-entries int max number of files to extract when --value is an archive (default 10000)
 --max-extract-size string max total uncompressed size to extract when --value is an archive (default "1GiB")
 --name string name of the material as shown in the contract
 --no-strict-validation skip strict schema validation for structured materials (SBOM_CYCLONEDX_JSON, OPENAPI_SPEC, ASYNCAPI_SPEC, OSSF_SCORECARD_JSON)
---policy-input-from-file stringArray feed a policy input from a column of a CSV or JSON file, in the format [<policy>:]<input>=<file>[:<column>] (e.g. ignored_paths=exception.csv:Path); an optional <policy>: prefix scopes the input to a single policy (matched by name or ref), otherwise it applies to every declaring policy; <column> is a single top-level column/field name and defaults to the input name; repeatable. The file is also recorded as EVIDENCE.
+--policy-input stringArray set a policy input to a literal value that REPLACES (overrides) any contract-declared value for the input, in the format [<policy>:]<input>=<value> (e.g. min_iterations=10); use this to override a scalar input at run time; an optional <policy>: prefix scopes it to a single policy (matched by name or ref), otherwise it applies to every declaring policy; repeatable.
+--policy-input-from-file stringArray feed a policy input from a column of a CSV or JSON file, in the format [<policy>:]<input>=<file>[:<column>] (e.g. ignored_paths=exception.csv:Path); the values are APPENDED to any contract-declared value; an optional <policy>: prefix scopes the input to a single policy (matched by name or ref), otherwise it applies to every declaring policy; <column> is a single top-level column/field name and defaults to the input name; repeatable. The file is also recorded as EVIDENCE.
 --registry-password string registry password, ($CHAINLOOP_REGISTRY_PASSWORD)
 --registry-server string OCI repository server, ($CHAINLOOP_REGISTRY_SERVER)
 --registry-username string registry username, ($CHAINLOOP_REGISTRY_USERNAME)

app/cli/pkg/action/attestation_add.go

@@ -101,16 +101,16 @@ func NewAttestationAdd(cfg *AttestationAddOpts) (*AttestationAdd, error) {
 
 var ErrAttestationNotInitialized = errors.New("attestation not yet initialized")
 
-func (action *AttestationAdd) Run(ctx context.Context, attestationID, materialName, materialValue, materialType string, annotations map[string]string, policyInputFiles []*PolicyInputFromFile) ([]*AttestationStatusMaterial, error) {
+func (action *AttestationAdd) Run(ctx context.Context, attestationID, materialName, materialValue, materialType string, annotations map[string]string, policyInputFiles []*PolicyInputFromFile, policyInputs []*PolicyInput) ([]*AttestationStatusMaterial, error) {
 	// initialize the crafter. If attestation-id is provided we assume the attestation is performed using remote state
 	crafter, err := newCrafter(&newCrafterStateOpts{enableRemoteState: (attestationID != ""), localStatePath: action.localStatePath}, action.CPConnection, action.opts...)
 	if err != nil {
  return nil, fmt.Errorf("failed to load crafter: %w", err)
 	}
 
-	// Resolve runtime policy inputs from the provided files before adding the
-	// material, so a malformed file aborts the add early.
-	runtimeInputs, err := buildRuntimeInputs(policyInputFiles)
+	// Resolve runtime policy inputs from the provided files and inline values
+	// before adding the material, so a malformed file aborts the add early.
+	runtimeInputs, err := buildRuntimeInputs(policyInputFiles, policyInputs)
 	if err != nil {
  return nil, err
 	}
@@ -163,7 +163,7 @@ func (action *AttestationAdd) Run(ctx context.Context, attestationID, materialNa
  // The runtime inputs still apply to every exploded material's policy
  // evaluation (they flow through addOpts); only the per-input EVIDENCE
  // materials are not recorded on the explode path.
- action.Logger.Warn().Msg("--policy-input-from-file values apply to policy evaluation but are not recorded as evidence materials when expanding an archive")
+ action.Logger.Warn().Msg("policyinput files apply to policy evaluation but are not recorded as evidence materials when expanding an archive")
  }
  limits := materials.ArchiveLimits{MaxEntries: action.maxExtractEntries, MaxTotalSize: action.maxExtractSize}
  // AddMaterialsFromArchive also records the source archive as an EVIDENCE
@@ -249,7 +249,8 @@ func shouldExplode(materialType, value string) (materials.ArchiveFormat, error)
 // returns nil when there are none. Defined at package scope so it can name the
 // crafter package type (the Run method shadows it with a local variable).
 func runtimeInputAddOpts(runtimeInputs *policies.RuntimeInputs) []crafter.AddOpt {
-	if runtimeInputs == nil || (len(runtimeInputs.Global) == 0 && len(runtimeInputs.Scoped) == 0) {
+	if runtimeInputs == nil || (len(runtimeInputs.Global) == 0 && len(runtimeInputs.Scoped) == 0 &&
+ len(runtimeInputs.GlobalOverride) == 0 && len(runtimeInputs.ScopedOverride) == 0) {
  return nil
 	}
 	return []crafter.AddOpt{crafter.WithRuntimeInputs(runtimeInputs)}
@@ -262,43 +263,71 @@ func withSourceArchiveEvidence(opts []crafter.AddOpt) []crafter.AddOpt {
 	return append(opts, crafter.WithSourceArchiveEvidence())
 }
 
-// buildRuntimeInputs reads each policy input file and returns the extracted
-// values grouped for the policy engine: unscoped entries under Global and
-// policy-scoped entries under Scoped[policy]. Values are newline-joined and
-// accumulated via policies.MergeRuntimeInputs so repeated inputs merge using the
-// same multi-value encoding the engine expects (it splits inputs back on
-// newlines and commas). As with contract-declared arguments, individual values
-// must not embed those delimiters; path globs, the intended use, never do.
-func buildRuntimeInputs(policyInputFiles []*PolicyInputFromFile) (*policies.RuntimeInputs, error) {
-	if len(policyInputFiles) == 0 {
+// buildRuntimeInputs reads each policy input file and combines it with the
+// inline --policy-input values, returning them grouped for the policy engine.
+// File inputs (--policy-input-from-file) go under Global/Scoped and are
+// newline-joined via policies.MergeRuntimeInputs so repeated inputs merge using
+// the multi-value encoding the engine expects (it splits inputs back on newlines
+// and commas). Inline values (--policy-input) go under GlobalOverride/ScopedOverride
+// and replace the contract value instead of appending, keeping a scalar override
+// a scalar. As with contract-declared arguments, individual append values must
+// not embed those delimiters; path globs, the intended use, never do.
+func buildRuntimeInputs(policyInputFiles []*PolicyInputFromFile, policyInputs []*PolicyInput) (*policies.RuntimeInputs, error) {
+	if len(policyInputFiles) == 0 && len(policyInputs) == 0 {
  return nil, nil
 	}
 
 	ri := &policies.RuntimeInputs{
- Global: map[string]string{},
- Scoped: map[string]map[string]string{},
+ Global: map[string]string{},
+ Scoped: map[string]map[string]string{},
+ GlobalOverride: map[string]string{},
+ ScopedOverride: map[string]map[string]string{},
 	}
+
 	for _, pif := range policyInputFiles {
  values, err := ExtractColumnValues(pif.File, pif.Column)
  if err != nil {
  return nil, fmt.Errorf("extracting %q from %q: %w", pif.Column, pif.File, err)
  }
 
- // Unscoped entries go to Global; policy-scoped entries to their own
- // Scoped[policy] map. Because global and scoped values live in separate
- // maps, they never collide here even when they share an input name;
- // forPolicy is what later merges a policy's scoped values over Global.
- add := map[string]string{pif.Input: strings.Join(values, "\n")}
- if pif.Policy == "" {
- ri.Global = policies.MergeRuntimeInputs(ri.Global, add)
- } else {
- ri.Scoped[pif.Policy] = policies.MergeRuntimeInputs(ri.Scoped[pif.Policy], add)
- }
+ addAppendInput(ri, pif.Policy, pif.Input, strings.Join(values, "\n"))
+	}
+
+	for _, pi := range policyInputs {
+ addOverrideInput(ri, pi.Policy, pi.Input, pi.Value)
 	}
 
 	return ri, nil
 }
 
+// addAppendInput accumulates an append-mode runtime input. Unscoped entries go
+// to Global; policy-scoped entries to their own Scoped[policy] map. Because
+// global and scoped values live in separate maps they never collide here even
+// when they share an input name; forPolicy is what later merges a policy's
+// scoped values over Global.
+func addAppendInput(ri *policies.RuntimeInputs, policy, input, value string) {
+	add := map[string]string{input: value}
+	if policy == "" {
+ ri.Global = policies.MergeRuntimeInputs(ri.Global, add)
+	} else {
+ ri.Scoped[policy] = policies.MergeRuntimeInputs(ri.Scoped[policy], add)
+	}
+}
+
+// addOverrideInput records a replace-mode runtime input. When the same key is
+// supplied more than once the last value wins, since a replace — unlike an
+// append — has no meaningful accumulation.
+func addOverrideInput(ri *policies.RuntimeInputs, policy, input, value string) {
+	if policy == "" {
+ ri.GlobalOverride[input] = value
+ return
+	}
+	if ri.ScopedOverride[policy] == nil {
+ ri.ScopedOverride[policy] = map[string]string{}
+	}
+	ri.ScopedOverride[policy][input] = value
+}
+
 // addPolicyInputEvidence adds each policy input file as an EVIDENCE material,
 // cross-linked with the evaluated material in both directions via the
 // chainloop.material.references annotation: each evidence material points at the