feat(prinfo): promote prinfo to a public package by jiparis · Pull Request #3381 · chainloop-dev/chainloop

jiparis · 2026-08-27T16:59:38Z

Summary

internal/prinfo held the CHAINLOOP_PR_INFO types, and internal/schemavalidators held the pr-info JSON schemas and their version constants. Go's internal-package rule makes both unimportable from other modules, so consumers had no option but to hand-copy the material shape and the schema id.

This promotes the package to pkg/prinfo and moves the pr-info JSON schemas alongside the types.

Public API

The existing types: Evidence, Data, Author, Reviewer, NewEvidence, EvidenceID, EvidenceSchemaURL.
Version with Version1_0…Version1_3, LatestVersion and Versions().
SchemaURL(Version) — the canonical published schema id.
Schema(Version) — the raw schema document, so consumers can validate against the canonical schema instead of vendoring a copy.
Validate(data, version) — an empty version defaults to LatestVersion.

PRInfoVersion* and ValidatePRInfo are removed from internal/schemavalidators, so the versions are declared in a single place.

Schema 1.2 fix

pr-info-1.2.schema.json had been silently regenerated from a later revision of the Data struct by a stale //go:generate directive, in an unrelated commit (300adaf). The published 1.2 schema therefore required the object-form author that was only introduced in 1.3, and rejected the string-form payloads it had been published to accept.

The schema is restored to its intended content, and the //go:generate directive is removed: published schemas are immutable, and the generator becomes a manual scaffold for cutting a new version. Regenerating 1.3 would likewise have dropped its hand-written string/object author union, which the reflector cannot express.

AI disclosure

This contribution was produced with the assistance of Claude Code.

Move internal/prinfo to pkg/prinfo so consumers outside this module can use the CHAINLOOP_PR_INFO types instead of hand-copying them. The pr-info JSON schemas move alongside the types, and the package now exposes the schema versions, the canonical schema URLs, the raw schema documents and a Validate function. The PRInfoVersion constants and ValidatePRInfo are removed from internal/schemavalidators so the versions are declared in a single place. Also restores pr-info-1.2.schema.json, which a stale //go:generate directive had silently regenerated from a later revision of the Data struct, making the published 1.2 schema require the object-form author introduced in 1.3. The directive is removed: published schemas are immutable and the generator is now a manual scaffold for cutting a new version. Assisted-by: Claude Code Signed-off-by: Jose I. Paris <jiparis@chainloop.dev> Chainloop-Trace-Sessions: 1fcad8c1-fedc-4783-aece-b4fbb6966acc

chainloop-platform · 2026-08-27T16:59:46Z

AI Session Checks — 🟡 83% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 83%	1	✅ 0	100% AI / 0% Human	29	+1443 / -1231	5h38m21s

🟡 83% — 100% AI — ✅ All policies passing

Aug 27, 2026 15:57 UTC · 5h38m21s · $11.57 · 248 in / 59.2k out · claude-code 2.1.247 (claude-opus-5)

View session details ↗

Change Summary

Promotes internal/prinfo to public pkg/prinfo and exports schema/version APIs for platform consumers.
Moves published pr-info schemas and testdata into pkg/prinfo, updates validators and crafters, and adds schema regression tests.
Fixes schema-generation safety by restoring published behavior and requiring --version before regenerating schemas.

AI Session Overall Score

🟡 83% — Well-verified implementation, but a planning gap and one corrected overclaim keep this yellow.

AI Session Analysis Breakdown

🟢 90% · scope-discipline

🟢 Touched files stayed inside the prinfo promotion, call-site updates, tests, and review fix. · High Impact

🟢 90% · verification

🟢 AI exercised generate.go across failure and success paths before committing the review fix. · High Impact

🟢 88% · user-trust-signal

No notes.

🟢 86% · solution-quality

🟢 AI traced schema drift to the generator path and fixed the corruption source. · High Impact

🟡 72% · alignment

🟠 AI said published schemas were immutable, but review showed generate.go still rewrote 1.3 by default. · Medium Severity

💡 Before stating an invariant, exercise the unsafe path once so the summary matches the actual guardrails.

🟡 68% · context-and-planning

🟠 This multi-package public API move started without a written plan, TODO list, or shared step breakdown. · Medium Severity

💡 For multi-package moves, write a short shared plan before editing so scope and checkpoints stay explicit.

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
deleted	ai	`internal/prinfo/prinfo_test.go`	+0 / -440
created	ai	`pkg/prinfo/prinfo_test.go`	+438 / -0
created	ai	`pkg/prinfo/schema_test.go`	+201 / -0
deleted	ai	`internal/schemavalidators/internal_schemas/prinfo/pr-info-1.3.schema.json`	+0 / -133
created	ai	`pkg/prinfo/schemas/pr-info-1.3.schema.json`	+133 / -0
created	ai	`pkg/prinfo/schema.go`	+130 / -0
deleted	ai	`internal/schemavalidators/internal_schemas/prinfo/pr-info-1.2.schema.json`	+0 / -124
deleted	ai	`internal/prinfo/prinfo.go`	+0 / -117
created	ai	`pkg/prinfo/prinfo.go`	+117 / -0
created	ai	`pkg/prinfo/schemas/pr-info-1.2.schema.json`	+104 / -0
deleted	ai	`internal/schemavalidators/internal_schemas/prinfo/pr-info-1.1.schema.json`	+0 / -88
created	ai	`pkg/prinfo/schemas/pr-info-1.1.schema.json`	+88 / -0
modified	ai	`pkg/prinfo/schemas/generate.go`	+69 / -7
modified	ai	`internal/schemavalidators/schemavalidators.go`	+0 / -71
deleted	ai	`internal/prinfo/generator.go`	+0 / -69
created	ai	`pkg/prinfo/generator.go`	+69 / -0
deleted	ai	`internal/schemavalidators/internal_schemas/prinfo/pr-info-1.0.schema.json`	+0 / -61
created	ai	`pkg/prinfo/schemas/pr-info-1.0.schema.json`	+61 / -0
deleted	ai	`internal/prinfo/schemas/generate.go`	+0 / -45
modified	ai	`internal/schemavalidators/schemavalidators_test.go`	+0 / -41
deleted	ai	`internal/schemavalidators/testdata/pr_info_valid.json`	+0 / -21
created	ai	`pkg/prinfo/testdata/pr_info_valid.json`	+21 / -0
modified	ai	`pkg/attestation/crafter/materials/chainloop_pr_info_test.go`	+4 / -5
modified	ai	`pkg/attestation/crafter/materials/chainloop_pr_info.go`	+2 / -3
deleted	ai	`internal/schemavalidators/testdata/pr_info_missing_required.json`	+0 / -3

…and 4 more file(s).

Policies (4)

Status	Policy	Material	Messages
✅ Passed	`ai-config-ai-agents-allowed`	`ai-coding-session-1fcad8`	-
✅ Passed	`ai-config-no-dangerous-commands`	`ai-coding-session-1fcad8`	-
✅ Passed	`ai-config-no-secrets`	`ai-coding-session-1fcad8`	-
✅ Passed	`ai-config-mcp-servers-allowed`	`ai-coding-session-1fcad8`	-

Security Checks — evaluating

Policies are still being evaluated. Results will update once available.

`iac-scan`

⏭️ 2 scans not applied

Scan	Reason
`vulnerability-scan`	no manifest/lockfile changed
`github-actions-scan`	no workflow files changed

Powered by Chainloop and Chainloop Trace

cubic-dev-ai

All reported issues were addressed across 19 files

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

The generator defaulted to LatestVersion, so running it with no arguments overwrote the published 1.3 schema from the current Data struct, dropping the hand-written string/object author union. That is the same corruption this branch repairs for 1.2, reachable by simply running the tool. --version is now required, and a version that is already embedded is refused unless --force is passed. Assisted-by: Claude Code Signed-off-by: Jose I. Paris <jiparis@chainloop.dev> Chainloop-Trace-Sessions: 1fcad8c1-fedc-4783-aece-b4fbb6966acc

cubic-dev-aiBot reviewed Aug 27, 2026
View reviewed changes

Comment threadpkg/prinfo/schemas/generate.go Outdated

jiparis requested a review from a teamAugust 27, 2026 17:12

migmartri previously approved these changes Aug 27, 2026
View reviewed changes

jiparis added 2 commits August 27, 2026 23:31

remove comment
3fd013c
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

jiparis dismissed migmartri’s stale review via 33c3802August 27, 2026 21:36

jiparis requested review from a team and migmartri August 27, 2026 21:49

javirln approved these changes Aug 28, 2026
View reviewed changes

jiparis merged commit 28d5c7d into chainloop-dev:mainAug 28, 2026
17 checks passed

jiparis deleted the jiparis/pfm-7070-make-prinfo-public branch August 28, 2026 10:11

Navigation Menu

Uh oh!

feat(prinfo): promote prinfo to a public package - #3381

feat(prinfo): promote prinfo to a public package#3381
jiparis merged 3 commits into
chainloop-dev:mainfrom
jiparis:jiparis/pfm-7070-make-prinfo-public

jiparis commented Aug 27, 2026•
edited
Loading

Uh oh!

chainloop-platformBot commented Aug 27, 2026•
edited
Loading

🟡 83% — 100% AI — ✅ All policies passing

Change Summary

AI Session Overall Score

AI Session Analysis Breakdown

🟢 90% · scope-discipline

🟢 90% · verification

🟢 88% · user-trust-signal

🟢 86% · solution-quality

🟡 72% · alignment

🟡 68% · context-and-planning

File Attribution

Policies (4)

⏭️ 2 scans not applied

Uh oh!

cubic-dev-aiBot left a comment •
edited
Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

jiparis commented Aug 27, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Public API

Schema 1.2 fix

AI disclosure

Uh oh!

chainloop-platformBot commented Aug 27, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AI Session Checks — 🟡 83% · ✅ 0 failing

🟡 83% — 100% AI — ✅ All policies passing

Change Summary

AI Session Overall Score

AI Session Analysis Breakdown

🟢 90% · scope-discipline

🟢 90% · verification

🟢 88% · user-trust-signal

🟢 86% · solution-quality

🟡 72% · alignment

🟡 68% · context-and-planning

File Attribution

Policies (4)

Security Checks — evaluating

iac-scan

⏭️ 2 scans not applied

Uh oh!

cubic-dev-aiBot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jiparis commented Aug 27, 2026•
edited
Loading

chainloop-platformBot commented Aug 27, 2026•
edited
Loading

`iac-scan`

cubic-dev-aiBot left a comment •
edited
Loading