feat(controlplane): make cas-backend used during attestation immutable

app/cli/cmd/attestation_add.go

@@ -16,16 +16,13 @@
 package cmd
 
 import (
-	"context"
 	"errors"
 
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 	"google.golang.org/grpc"
 
 	"github.com/chainloop-dev/chainloop/app/cli/internal/action"
-	pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
-	"github.com/chainloop-dev/chainloop/internal/grpcconn"
 )
 
 func newAttestationAddCmd() *cobra.Command {
@@ -38,27 +35,13 @@ func newAttestationAddCmd() *cobra.Command {
 		Annotations: map[string]string{
 			useWorkflowRobotAccount: "true",
 		},
-		PreRunE: func(cmd *cobra.Command, args []string) error {
-			var err error
-
-			// Retrieve temporary credentials for uploading
-			// TODO: only do it for artifact uploads
-			client := pb.NewAttestationServiceClient(actionOpts.CPConnection)
-			resp, err := client.GetUploadCreds(context.Background(), &pb.AttestationServiceGetUploadCredsRequest{})
-			if err != nil {
-				return newGracefulError(err)
-			}
-
-			artifactCASConn, err = grpcconn.New(viper.GetString(confOptions.CASAPI.viperKey), resp.Result.Token, flagInsecure)
-			if err != nil {
-				return newGracefulError(err)
-			}
-
-			return nil
-		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			a := action.NewAttestationAdd(
-				&action.AttestationAddOpts{ActionsOpts: actionOpts, ArtifactsCASConn: artifactCASConn},
+				&action.AttestationAddOpts{
+					ActionsOpts:        actionOpts,
+					CASURI:             viper.GetString(confOptions.CASAPI.viperKey),
+					ConnectionInsecure: flagInsecure,
+				},
 			)
 
 			err := a.Run(name, value)

app/cli/internal/action/attestation_add.go

@@ -16,32 +16,38 @@
 package action
 
 import (
+	"context"
 	"errors"
 
+	pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
 	"github.com/chainloop-dev/chainloop/internal/attestation/crafter"
 	"github.com/chainloop-dev/chainloop/internal/casclient"
+	"github.com/chainloop-dev/chainloop/internal/grpcconn"
 	"google.golang.org/grpc"
 )
 
 type AttestationAddOpts struct {
 	*ActionsOpts
-	ArtifactsCASConn *grpc.ClientConn
+	ArtifactsCASConn   *grpc.ClientConn
+	CASURI             string
+	ConnectionInsecure bool
 }
 
 type AttestationAdd struct {
 	*ActionsOpts
-	c                *crafter.Crafter
-	artifactsCASConn *grpc.ClientConn
+	c                  *crafter.Crafter
+	casURI             string
+	connectionInsecure bool
 }
 
 func NewAttestationAdd(cfg *AttestationAddOpts) *AttestationAdd {
 	return &AttestationAdd{
 		ActionsOpts: cfg.ActionsOpts,
 		c: crafter.NewCrafter(
 			crafter.WithLogger(&cfg.Logger),
-			crafter.WithUploader(casclient.New(cfg.ArtifactsCASConn, casclient.WithLogger(cfg.Logger))),
 		),
-		artifactsCASConn: cfg.ArtifactsCASConn,
+		casURI:             cfg.CASURI,
+		connectionInsecure: cfg.ConnectionInsecure,
 	}
 }
 
@@ -57,7 +63,25 @@ func (action *AttestationAdd) Run(k, v string) error {
 		return err
 	}
 
-	if err := action.c.AddMaterial(k, v); err != nil {
+	// Get upload creds for the current attestation and set up CAS client
+	client := pb.NewAttestationServiceClient(action.CPConnection)
+	creds, err := client.GetUploadCreds(context.Background(),
+		&pb.AttestationServiceGetUploadCredsRequest{
+			WorkflowRunId: action.c.CraftingState.GetAttestation().GetWorkflow().GetWorkflowRunId(),
+		},
+	)
+	if err != nil {
+		return err
+	}
+	artifactCASConn, err := grpcconn.New(action.casURI, creds.Result.Token, action.connectionInsecure)
+	if err != nil {
+		return err
+	}
+	defer artifactCASConn.Close()
+
+	cc := casclient.New(artifactCASConn, casclient.WithLogger(action.Logger))
+
+	if err := action.c.AddMaterial(k, v, cc); err != nil {
 		action.Logger.Err(err).Msg("adding material")
 		return err
 	}

app/controlplane/Makefile

@@ -28,7 +28,7 @@ local_db = postgres://postgres:@localhost:5432/controlplane?sslmode=disable
 
 .PHONY: migration_apply
 # run migrations against local db
-migration_apply: check-atlas-tool
+migration_apply: check-atlas-tool migration_hash
 	atlas migrate status --dir ${local_migrations_dir} --url ${local_db}
 	atlas migrate apply --dir ${local_migrations_dir} --url ${local_db}
 

app/controlplane/api/controlplane/v1/workflow_run.proto

@@ -113,7 +113,10 @@ message WorkflowRunServiceViewResponse {
 }
 
 
-message AttestationServiceGetUploadCredsRequest {}
+message AttestationServiceGetUploadCredsRequest {
+    string workflow_run_id = 1;
+}
+
 message AttestationServiceGetUploadCredsResponse {
   Result result = 1;