feat: introduce PR mode for attestations

[migmartri]

What

Introduces a "PR mode" for attestations that captures and propagates the pull/merge request signal as a top-level annotation on the attestation.

Changes

• --pr flag on chainloop attestation init: explicitly marks the attestation as a PR/MR build. Auto-detected from the CI runner environment (GitHub Actions GITHUB_EVENT_NAME=pull_request, GitLab CI_PIPELINE_SOURCE=merge_request_event) when not set. --pr=false forces it off.

• chainloop.dev/is-pull-request=true annotation: set on the attestation when in PR mode, so downstream consumers (e.g. findings processing) can detect PR-originated attestations and skip reprocessing.

• Skip latest promotion: when in PR mode, mark-latest defaults to false (replacing the manual --mark-latest=false workaround). An explicitly passed --mark-latest=true still wins.

• Push annotation preservation: the push path now preserves existing attestation-level annotations (like the PR marker) alongside contract and runtime annotations, instead of overwriting them.

Fixes #3265

Assisted-by: Claude Code

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri

[chainloop-platform]

AI Session Analysis

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 85%	1	✅ 0	99% AI / 1% Human	7	+247 / -3	11m4s

🟢 85% — 99% AI — ✅ All policies passing

Jul 6, 2026 15:19 UTC · 11m4s · $1.25 · 208.1k in / 15.2k out · opencode 1.17.13 (z-ai/glm-5.2)

View session details ↗

Change Summary

• Adds a --pr flag to attestation init, with runner-based PR detection and mark-latest defaulting off in PR mode.
• Tags attestations with chainloop.dev/is-pull-request and preserves that annotation during push.
• Adds targeted crafter and action tests, regenerates CLI docs, and runs build, test, format, lint, and simplify checks.

AI Session Overall Score

🟢 85% — Strong feature delivery and verification effort, with test outcomes visible only by self-report.

AI Session Analysis Breakdown

🟢 92% · alignment

No notes.

🟢 90% · solution-quality

🟢 AI fixed annotation preservation in push instead of leaving PR mode half-implemented. · High Impact

🟢 88% · context-and-planning

🟢 AI read both issue trackers and wrote a concrete todo list before editing. · High Impact

🟢 87% · user-trust-signal

No notes.

🟢 86% · scope-discipline

No notes.

🟡 70% · verification

🟢 AI added targeted tests for PR annotations and PR-mode resolution helpers. · High Impact

🟠 Targeted go test commands were issued, but the transcript does not preserve their pass/fail output. · Medium Severity

💡 Before claiming tests pass, preserve or quote the runner's pass/fail line in-session.

---

File Attribution

███████████████████░ 99% AI / 1% Human

Status	Attribution	File	Lines
modified	ai	app/cli/pkg/action/attestation_init_test.go	+120 / -3
modified	ai	pkg/attestation/crafter/crafter_test.go	+53 / -0
modified	ai	app/cli/pkg/action/attestation_init.go	+40 / -0
modified	ai	pkg/attestation/crafter/crafter.go	+18 / -0
modified	ai	app/cli/cmd/attestation_init.go	+8 / -0
modified	ai	app/cli/pkg/action/attestation_push.go	+7 / -0
modified	human	app/cli/documentation/cli-reference.mdx	+1 / -0

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-ses-0c	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-ses-0c	-
✅ Passed	ai-config-no-secrets	ai-coding-session-ses-0c	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-ses-0c	-

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 7 files

_{Re-trigger cubic}