expose generic evaluation in policy verifier

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

Author: Piskoo

app/cli/internal/policydevel/eval.go

@@ -61,6 +61,12 @@ type EvalSummaryDebugInfo struct {
 }
 
 func Evaluate(opts *EvalOptions, logger zerolog.Logger) (*EvalSummary, error) {
+	// Check if this is a generic policy evaluation
+	if opts.MaterialPath == "" {
+		return evaluateGeneric(opts, logger)
+	}
+
+	// Material-based evaluation
 	// 1. Craft material with annotations
 	material, err := craftMaterial(opts.MaterialPath, opts.MaterialKind, &logger)
 	if err != nil {
@@ -83,6 +89,38 @@ func Evaluate(opts *EvalOptions, logger zerolog.Logger) (*EvalSummary, error) {
 	return summary, nil
 }
 
+func evaluateGeneric(opts *EvalOptions, logger zerolog.Logger) (*EvalSummary, error) {
+	// Create policy attachment without material selector
+	ref := opts.PolicyPath
+	scheme, _ := policies.RefParts(opts.PolicyPath)
+	if scheme == "" {
+		// Default to file://
+		ref = fmt.Sprintf("file://%s", opts.PolicyPath)
+	}
+
+	attachment := &v1.PolicyAttachment{
+		Policy: &v1.PolicyAttachment_Ref{Ref: ref},
+		With:   opts.Inputs,
+	}
+
+	// Create policy verifier
+	verifierOpts := buildPolicyVerifierOptions(opts.AllowedHostnames, opts.Debug)
+	pol := &v1.Policies{}
+	v := policies.NewPolicyVerifier(pol, opts.AttestationClient, &logger, verifierOpts...)
+
+	// Evaluate generic policy
+	policyEv, err := v.EvaluateGeneric(context.Background(), attachment, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	if policyEv == nil {
+		return nil, fmt.Errorf("no execution branch matched, or all of them were ignored")
+	}
+
+	return buildEvalSummary(policyEv, opts.Debug), nil
+}
+
 func createPolicies(policyPath string, inputs map[string]string, materialID string) (*v1.Policies, error) {
 	// Check if the policy path already has a scheme (chainloop://, http://, https://, file://)
 	ref := policyPath
@@ -97,25 +135,14 @@ func createPolicies(policyPath string, inputs map[string]string, materialID stri
 			{
 				Policy: &v1.PolicyAttachment_Ref{Ref: ref},
 				With:   inputs,
-				// Add selector to support generic policies
-				Selector: &v1.PolicyAttachment_MaterialSelector{
-					Name: materialID,
-				},
 			},
 		},
 		Attestation: nil,
 	}, nil
 }
 
 func verifyMaterial(pol *v1.Policies, material *v12.Attestation_Material, materialPath string, debug bool, allowedHostnames []string, attestationClient controlplanev1.AttestationServiceClient, logger *zerolog.Logger) (*EvalSummary, error) {
-	var opts []policies.PolicyVerifierOption
-	if len(allowedHostnames) > 0 {
-		opts = append(opts, policies.WithAllowedHostnames(allowedHostnames...))
-	}
-
-	opts = append(opts, policies.WithIncludeRawData(debug))
-	opts = append(opts, policies.WithEnablePrint(enablePrint))
-
+	opts := buildPolicyVerifierOptions(allowedHostnames, debug)
 	v := policies.NewPolicyVerifier(pol, attestationClient, logger, opts...)
 	policyEvs, err := v.VerifyMaterial(context.Background(), material, materialPath)
 	if err != nil {
@@ -127,8 +154,22 @@ func verifyMaterial(pol *v1.Policies, material *v12.Attestation_Material, materi
 	}
 
 	// Only one evaluation expected for a single policy attachment
-	policyEv := policyEvs[0]
+	return buildEvalSummary(policyEvs[0], debug), nil
+}
 
+// buildPolicyVerifierOptions creates common policy verifier options
+func buildPolicyVerifierOptions(allowedHostnames []string, debug bool) []policies.PolicyVerifierOption {
+	var opts []policies.PolicyVerifierOption
+	if len(allowedHostnames) > 0 {
+		opts = append(opts, policies.WithAllowedHostnames(allowedHostnames...))
+	}
+	opts = append(opts, policies.WithIncludeRawData(debug))
+	opts = append(opts, policies.WithEnablePrint(enablePrint))
+	return opts
+}
+
+// buildEvalSummary converts a PolicyEvaluation to an EvalSummary
+func buildEvalSummary(policyEv *v12.PolicyEvaluation, debug bool) *EvalSummary {
 	summary := &EvalSummary{
 		Result: &EvalResult{
 			Skipped:     policyEv.GetSkipped(),
@@ -153,7 +194,7 @@ func verifyMaterial(pol *v1.Policies, material *v12.Attestation_Material, materi
 			if rr == nil {
 				continue
 			}
-			// Take the first input found, as we only allow one material input
+			// Take the first input found
 			if len(summary.DebugInfo.Inputs) == 0 && rr.Input != nil {
 				summary.DebugInfo.Inputs = append(summary.DebugInfo.Inputs, json.RawMessage(rr.Input))
 			}
@@ -164,7 +205,7 @@ func verifyMaterial(pol *v1.Policies, material *v12.Attestation_Material, materi
 		}
 	}
 
-	return summary, nil
+	return summary
 }
 
 func craftMaterial(materialPath, materialKind string, logger *zerolog.Logger) (*v12.Attestation_Material, error) {
@@ -174,19 +215,6 @@ func craftMaterial(materialPath, materialKind string, logger *zerolog.Logger) (*
 		Uploader: nil, // Skip uploads
 	}
 
-	// If no material path provided, create empty material
-	if materialPath == "" {
-		return &v12.Attestation_Material{
-			Id: "empty-input",
-			M: &v12.Attestation_Material_String_{
-				String_: &v12.Attestation_Material_KeyVal{
-					Id:    "empty-input",
-					Value: "{}",
-				},
-			},
-		}, nil
-	}
-
 	// Explicit kind
 	if materialKind != "" {
 		kind, ok := v1.CraftingSchema_Material_MaterialType_value[materialKind]

app/cli/internal/policydevel/eval_test.go

@@ -236,4 +236,86 @@ func TestEvaluateGenericPolicies(t *testing.T) {
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "missing required input")
 	})
+
+	t.Run("kind-only policy without material - should fail", func(t *testing.T) {
+		opts := &EvalOptions{
+			PolicyPath: "testdata/kind-only-policy.yaml",
+			Inputs: map[string]string{
+				"environment": "production",
+			},
+		}
+
+		_, err := Evaluate(opts, logger)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "no execution branch matched, or all of them were ignored")
+	})
+}
+
+func TestEvaluateMultiKindPolicies(t *testing.T) {
+	logger := zerolog.New(os.Stderr)
+
+	t.Run("multi-kind policy with generic evaluation - only generic script runs", func(t *testing.T) {
+		opts := &EvalOptions{
+			PolicyPath: "testdata/multi-kind-policy.yaml",
+			Inputs: map[string]string{
+				"environment": "production",
+			},
+		}
+
+		result, err := Evaluate(opts, logger)
+		require.NoError(t, err)
+		require.NotNil(t, result)
+		assert.False(t, result.Result.Skipped)
+
+		require.Len(t, result.Result.Violations, 1)
+		assert.Contains(t, result.Result.Violations[0], "Generic check")
+		assert.NotContains(t, result.Result.Violations[0], "SBOM-specific")
+	})
+
+	t.Run("multi-kind policy with generic evaluation - staging no violations", func(t *testing.T) {
+		opts := &EvalOptions{
+			PolicyPath: "testdata/multi-kind-policy.yaml",
+			Inputs: map[string]string{
+				"environment": "staging",
+			},
+		}
+
+		result, err := Evaluate(opts, logger)
+		require.NoError(t, err)
+		require.NotNil(t, result)
+		assert.False(t, result.Result.Skipped)
+
+		assert.Empty(t, result.Result.Violations)
+	})
+
+	t.Run("multi-kind policy with SBOM material - only SBOM-specific policy runs", func(t *testing.T) {
+		tempDir := t.TempDir()
+
+		sbomContent := `{
+			"bomFormat": "CycloneDX",
+			"specVersion": "1.4",
+			"version": 1,
+			"components": []
+		}`
+		sbomPath := filepath.Join(tempDir, "test-sbom.json")
+		require.NoError(t, os.WriteFile(sbomPath, []byte(sbomContent), 0600))
+
+		opts := &EvalOptions{
+			PolicyPath:   "testdata/multi-kind-policy.yaml",
+			MaterialPath: sbomPath,
+			MaterialKind: "SBOM_CYCLONEDX_JSON",
+			Inputs: map[string]string{
+				"environment": "production",
+			},
+		}
+
+		result, err := Evaluate(opts, logger)
+		require.NoError(t, err)
+		require.NotNil(t, result)
+		assert.False(t, result.Result.Skipped)
+
+		require.Len(t, result.Result.Violations, 2)
+		assert.Contains(t, result.Result.Violations[0], "Generic check")
+		assert.Contains(t, result.Result.Violations[1], "SBOM-specific check")
+	})
 }

app/cli/internal/policydevel/testdata/kind-only-policy.yaml

@@ -0,0 +1,35 @@
+apiVersion: workflowcontract.chainloop.dev/v1
+kind: Policy
+metadata:
+  name: kind-only-policy
+  description: Policy with only kind-specific scripts (no generic)
+spec:
+  inputs:
+    - name: environment
+      description: Deployment environment
+      required: true
+  policies:
+    - kind: SBOM_CYCLONEDX_JSON
+      embedded: |
+        package main
+        import rego.v1
+
+        result := {
+            "violations": violations,
+        }
+
+        violations contains "SBOM check failed" if {
+            true
+        }
+    - kind: CONTAINER_IMAGE
+      embedded: |
+        package main
+        import rego.v1
+
+        result := {
+            "violations": violations,
+        }
+
+        violations contains "Container check failed" if {
+            true
+        }

app/cli/internal/policydevel/testdata/multi-kind-policy.yaml

@@ -0,0 +1,35 @@
+apiVersion: workflowcontract.chainloop.dev/v1
+kind: Policy
+metadata:
+  name: multi-kind-policy
+  description: Policy with multiple kinds - generic and material-specific
+spec:
+  inputs:
+    - name: environment
+      description: Deployment environment
+      required: true
+  policies:
+    - embedded: |
+        package main
+        import rego.v1
+
+        result := {
+            "violations": violations,
+        }
+
+        violations contains msg if {
+            input.args.environment == "production"
+            msg := "Generic check: production deployments require additional validation"
+        }
+    - kind: SBOM_CYCLONEDX_JSON
+      embedded: |
+        package main
+        import rego.v1
+
+        result := {
+            "violations": violations,
+        }
+
+        violations contains "SBOM-specific check: this should not run for generic evaluation" if {
+            true
+        }

pkg/policies/policies.go

@@ -159,6 +159,28 @@ func (pv *PolicyVerifier) VerifyMaterial(ctx context.Context, material *v12.Atte
 	return result, nil
 }
 
+// EvaluateGeneric evaluates a single policy attachment without material context.
+// This is used for generic policies that operate purely on input arguments.
+func (pv *PolicyVerifier) EvaluateGeneric(ctx context.Context, attachment *v1.PolicyAttachment, input []byte) (*v12.PolicyEvaluation, error) {
+	// Use empty JSON if no input provided
+	if len(input) == 0 {
+		input = []byte("{}")
+	}
+
+	// Evaluate without material context
+	ev, err := pv.evaluatePolicyAttachment(ctx, attachment, input,
+		&evalOpts{
+			kind: v1.CraftingSchema_Material_MATERIAL_TYPE_UNSPECIFIED,
+			name: "",
+		},
+	)
+	if err != nil {
+		return nil, NewPolicyError(err)
+	}
+
+	return ev, nil
+}
+
 type evalOpts struct {
 	name string
 	kind v1.CraftingSchema_Material_MaterialType