Merge branch 'main' into pfm-4021

Author: Piskoo

.chainloop.yml

@@ -1,6 +1,6 @@
 # This indicates the [current version]+next
 # to indicate that we are building a new version of the project
-projectVersion: v1.61.0+next
+projectVersion: v1.62.0+next
 
 # Experimental feature used by Chainloop labs shared workflow https://github.com/chainloop-dev/labs
 # It maps the material names with location in disk so they get automatically attested

.claude/skills/upgrading-golang/SKILL.md

@@ -99,6 +99,14 @@ FROM arigaio/atlas@sha256:NEW_DIGEST as base
 
 **7c. Update `./common.mk` for `make init`:**
 
+**IMPORTANT**: Before updating the version in common.mk, ALWAYS test that the Atlas version is available via the curl command:
+
+```bash
+curl -sSf https://atlasgo.sh | ATLAS_VERSION=vX.XX.X sh -s -- --version
+```
+
+If the command fails or the version is not available, do NOT update common.mk. Only the Docker image should be updated in this case.
+
 Update the Atlas CLI installation version in the `init` target:
 
 Pattern to replace:

.github/workflows/codeql.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

.github/workflows/github_release.yaml

@@ -28,6 +28,7 @@ jobs:
       CHAINLOOP_WORKFLOW_NAME: chainloop-vault-release
       CHAINLOOP_PROJECT: chainloop
       GH_TOKEN: ${{ github.token }}
+      INPUT_TAG: ${{ inputs.tag }}
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -37,12 +38,12 @@ jobs:
 
       - name: Initialize Attestation
         run: |
-          tag=$(echo -n ${{inputs.tag}} | cut -d / -f3)
+          tag=$(echo -n "$INPUT_TAG" | cut -d / -f3)
           chainloop attestation init --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT} --version "$tag"
 
       - name: Attest all assets
         run: |
-          tag=$(echo -n ${{inputs.tag}} | cut -d / -f3)
+          tag=$(echo -n "$INPUT_TAG" | cut -d / -f3)
           gh release download $tag -D /tmp/github-release
           for entry in $(ls /tmp/github-release); do
             # If the name is cas.cyclonedx.json, controlplane.cyclonedx.json or cli.cyclonedx.json, we need to add the attestation with the correct name
@@ -83,7 +84,7 @@ jobs:
         if: ${{ success() }}
         run: |
           chainloop_release_url="## Chainloop Attestation"$'\n'"[View the attestation of this release](https://app.chainloop.dev/attestation/${{ steps.attestation-push.outputs.attestation_sha }})"
-          current_notes=$(gh release view ${{inputs.tag}} --json body -q '.body')
+          current_notes=$(gh release view "$INPUT_TAG" --json body -q '.body')
 
           if echo "$current_notes" | grep -q "## Chainloop Attestation"; then
             # Replace the existing Chainloop Attestation section with the new URL
@@ -94,4 +95,4 @@ jobs:
           fi
 
           # Update the release notes and ignore if it fails since we might be lacking permissions to update the release notes
-          gh release edit ${{inputs.tag}} -n "$modified_notes" || echo -n "Not enough permissions to edit the release notes. Skipping..."
+          gh release edit "$INPUT_TAG" -n "$modified_notes" || echo -n "Not enough permissions to edit the release notes. Skipping..."

.github/workflows/lint.yml

@@ -26,7 +26,7 @@ jobs:
     steps:
       - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
 
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -67,7 +67,7 @@ jobs:
 
       - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
 
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 

.github/workflows/release.yaml

@@ -79,7 +79,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
 
       # install qemu binaries for multiarch builds (needed by goreleaser/buildx)
       - name: Setup qemu

.github/workflows/scm_configuration_check.yaml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Gather runner context data
         run: |
-          chainloop gather-runner-context --runner-token ${{ steps.generate-token.outputs.token }}
+          chainloop gather-runner-context --runner-token ${{ steps.generate-token.outputs.token }} --branches=main
 
       - name: Add runner context material to attestation
         run: |

.github/workflows/test.yml

@@ -27,7 +27,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
         with:
-          go-version: "1.25.3"
+          go-version: "1.25.5"
           cache: true
           cache-dependency-path: go.sum
 

.gitignore

@@ -41,6 +41,10 @@ bin/
 # Go releaser
 dist/
 
+# Node.js
+**/node_modules/
+**/dist/
+
 # Dev configuration associated with authentication
 */*/*/secret.yaml
 

CLAUDE.md

@@ -135,7 +135,7 @@ make migration_lint         # Lint migration files
 
 ## Key Technologies
 
-- **Language**: Go 1.25.3
+- **Language**: Go 1.25.5
 - **API**: gRPC with HTTP/JSON gateway, Protocol Buffers with buf
 - **Database**: PostgreSQL with Ent ORM, Atlas for migrations
 - **Authentication**: OIDC, JWT tokens