Repository navigation
Conversation
…level Adds an optional level to the contract update API and the --project and --org flags to 'chainloop workflow contract update', so organization admins can move a contract between the organization and a project while it keeps its revisions and workflows. Workflow updates now reject a contract of a different project, and conversions and workflow changes lock the contract. Implements spec issue-3644 (R-001 to R-010, D-008). Closes chainloop-dev#3644 Assisted-by: Claude Code Signed-off-by: Jose Ignacio Paris Prieto <jiparis@chainloop.dev> Chainloop-Trace-Sessions: bc6fbb4d-3bf8-4fd0-b81e-10aa03bf1e58
Contributor
PR validation —
|
| Status | Policy | Material | Messages |
|---|---|---|---|
pr-min-approvals |
pr-info |
PR/MR #3794 has 0 approving reviews, 1 required. | |
| ✅ Passed | pr-description-required |
pr-info |
- |
| ✅ Passed | pr-user-story-linked |
pr-info |
- |
AI Session Checks — ⚠️ no AI session found
Missing AI Coding Sessions
This organization requires every PR to be backed by a Chainloop Trace AI coding session, and none was found for this one.
Please make sure the AI coding session evidence has been sent by the Chainloop CLI, or add the skip-ai-session label to this PR to bypass this check.
Learn more about Chainloop Trace.
Security Checks — ✅ 6 passing
✅ Reviewed this change against the project's security context (23 concerns hunted) — no introduced risk found.
View in Chainloop ↗ · How this works ↗
✅ secret-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
✅ iac-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | iac-misconfiguration |
- |
Scans not applied (2)
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
Powered by Chainloop and Chainloop Trace
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 23 files
This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.
View guided diff | Re-trigger cubic
jiparis
commented
Nov 6, 2026
| // Converts the contract to a project-level contract of this project | ||
| IdentityReference project_reference = 6; | ||
| // Converts the contract to an organization-level contract. It must be true. | ||
| bool organization_scoped = 7 [(buf.validate.field).bool.const = true]; |
Member
Author
There was a problem hiding this comment.
what if the value is false or absent, will it fail the validation?
- Rename the CLI flag --org to --org-level. The local --org hid the global --org flag that selects the organization. Add a test that no command flag hides a global flag. - Take the old level of the audit event from the conversion, which reads it under the contract lock, and write the event only when the level changed. - Add validation tests for the level field of the update request. - Spec issue-3644: D-009 supersedes D-003, R-011 supersedes R-002, add D-010. Refs chainloop-dev#3644 Assisted-by: Claude Code Signed-off-by: Jose Ignacio Paris Prieto <jiparis@chainloop.dev> Chainloop-Trace-Sessions: bc6fbb4d-3bf8-4fd0-b81e-10aa03bf1e58
Contributor
There was a problem hiding this comment.
1 issue found across 9 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="app/controlplane/pkg/biz/workflowcontract.go">
<violation number="1" location="app/controlplane/pkg/biz/workflowcontract.go:487">
P2: `NewScope` is read from a post-commit query, so a concurrent conversion can make this event describe the next operation instead of this one. Capture the post-conversion scope while the conversion transaction holds the lock and use that snapshot for the audit event.</violation>
</file>
Reply with feedback, questions, or to request a fix.
View guided diff | Re-trigger cubic
| uc.auditorUC.Dispatch(ctx, &events.WorkflowContractScopeChanged{ | ||
| WorkflowContractBase: eventPayload.WorkflowContractBase, | ||
| OldScope: contractScopeForEvent(c.PreviousScopedEntity), | ||
| NewScope: contractScopeForEvent(c.Contract.ScopedEntity), |
Contributor
There was a problem hiding this comment.
P2: NewScope is read from a post-commit query, so a concurrent conversion can make this event describe the next operation instead of this one. Capture the post-conversion scope while the conversion transaction holds the lock and use that snapshot for the audit event.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At app/controlplane/pkg/biz/workflowcontract.go, line 487:
<comment>`NewScope` is read from a post-commit query, so a concurrent conversion can make this event describe the next operation instead of this one. Capture the post-conversion scope while the conversion transaction holds the lock and use that snapshot for the audit event.</comment>
<file context>
@@ -473,12 +478,13 @@ func (uc *WorkflowContractUseCase) Update(ctx context.Context, orgID, name strin
- OldScope: contractScopeForEvent(wfContractPreUpdate),
- NewScope: contractScopeForEvent(c.Contract),
+ OldScope: contractScopeForEvent(c.PreviousScopedEntity),
+ NewScope: contractScopeForEvent(c.Contract.ScopedEntity),
}, &orgUUID)
}
</file context>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Lets an organization admin convert an existing workflow contract between the organization level and a project level, in both directions. The contract keeps its ID, name, revisions, and workflows. This implements spec issue-3644.
organization_scoped. When it is not set, the level does not change (R-001, R-011, R-009).chainloop workflow contract updategets--project <name>and--org-level, which cannot be used together.WorkflowContractScopeChangedevent records the old and the new level, as read under the contract lock (R-008, D-010).Spec changes in this PR: D-009 supersedes D-003 (the flag is
--org-level, because a local--orghides the global organization flag), R-011 supersedes R-002 (the same requirement with the new flag), and D-010 is new.Closes #3644
AI disclosure: this change was implemented with the assistance of Claude Code.