Skip to content

feat(container): surface provenance attestations behind feature flag [PRIM-100] - #7098

Open
bdemeo12 wants to merge 1 commit into
mainfrom
PRIM-100/cli-provenance-attestations-ff-9.19.0
Open

feat(container): surface provenance attestations behind feature flag [PRIM-100]#7098
bdemeo12 wants to merge 1 commit into
mainfrom
PRIM-100/cli-provenance-attestations-ff-9.19.0

Conversation

@bdemeo12

@bdemeo12 bdemeo12 commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Duplicate of #7047, pinned to snyk-docker-plugin 9.19.0 instead of 9.20.0, rebuilt on current main.

Surfaces container image provenance attestations through the CLI, gated behind the surfaceProvenanceAttestations feature flag in filterDockerFacts, mirroring the existing allowNewContainerFacts pattern.

@bdemeo12 @claude
feat(container): surface provenance attestations behind feature flag …
ba68ca7 
…[PRIM-100]

Bump snyk-docker-plugin to ^9.19.0 (adds provenance attestation extraction and
the vcs.source fallback for buildConfigSourceUri) and gate the provenanceMetadata
fact behind the surfaceProvenanceAttestations feature flag in filterDockerFacts,
mirroring the allowNewContainerFacts pattern.

Pinned to 9.19.0 rather than 9.20.0 deliberately. 9.20.0 adds a best-effort
provenance fetch to the image's registry (snyk/snyk-docker-plugin#891). The
plugin handles a failed fetch and the scan completes, but the CLI records the
failed request as a command error and appends a second JSON object after the
result, which breaks JSON.parse in container.spec.ts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@bdemeo12
bdemeo12 requested a review from a team as a code owner August 7, 2026 17:49
@snyk-io

snyk-io Bot commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

github-actions Bot commented Aug 7, 2026 •
edited by atlassian Bot
Loading

Copy link
Copy Markdown
Contributor
Warnings
⚠️

You've modified files in src/ directory, but haven't updated anything in test folder. Is there something that could be tested?
⚠️

"[feat(container): surface provenance attestations behind feature flag PRIM-100](https://api.github.com/repos/snyk/cli/git/commits/ba68ca700e7fd50a2934beed2e1fd0583715f1b0)" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against ba68ca7

@snyk-pr-review-bot

snyk-pr-review-bot Bot commented Aug 7, 2026

Copy link
Copy Markdown

PR Reviewer Guide 🔍

🧪 No relevant tests
🔒 No security concerns identified
⚡ No major issues detected
📚 Repository Context Analyzed

This review considered 8 relevant code sections from 4 files (average relevance: 0.53)

🤖 Repository instructions applied (from AGENTS.md)

@bdemeo12
bdemeo12 enabled auto-merge August 10, 2026 13:38
PeterSchafer
PeterSchafer reviewed Aug 10, 2026
View reviewed changes
Comment thread src/lib/ecosystems/common.ts

// Provenance attestations are gated behind their own feature flag so they can be
// rolled out independently of the broader "new container facts" flag.
const PROVENANCE_METADATA_FACT_TYPE = 'provenanceMetadata';

@PeterSchafer PeterSchafer Aug 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Question: This constant seems to be a duplicate to what the snyk-docker-plugin contains, breaking the best practice of single source of truth. wouldn't it be possible to move the filtering into the plugin and hand over the feature flags from the CLI?

@bdemeo12 bdemeo12 Aug 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi Peter! I can do this, but I am blocked by this ask: https://snyksec.atlassian.net/servicedesk/customer/portal/64/CLIA-1576

which is why I implemented it like this!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PeterSchafer PeterSchafer PeterSchafer left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bdemeo12 @PeterSchafer