Repository navigation
feat(cli): create the trace workflow on init, attached to the AI coding session contract - #3415
Merged
Merged
Conversation
…ng session contract `chainloop trace init` and `trace run` now create the Chainloop workflow the trace attestations target, attached to the `chainloop-ai-coding-session` contract when the organization has it and to the control plane's default contract otherwise. Until now the workflow was created implicitly by the pre-push hook, always with an empty contract and with nobody reading the output, so trace sessions were never governed by a contract. The contract name can be overridden with the new `--contract` flag on both commands. It is resolved when the workflow is created and not persisted to .chainloop.yml, so the push path is unchanged. Existing workflows are never modified. `trace init` fails before writing anything when the workflow cannot be created; `trace run` warns and runs the session anyway. Updating .chainloop.yml now preserves the user's comments, key order and indentation instead of re-marshalling the file from a map. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: 90463ef4-5d43-4c6b-8369-d85c131c0ba8
Contributor
AI Session Checks —
|
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
PR info
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | pr-user-story-linked |
- |
| ✅ Passed | pr-description-required |
- |
⏭️ 3 scans not applied
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
iac-scan |
no IaC files changed |
Powered by Chainloop and Chainloop Trace
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 15 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
`chainloop trace init` reported a missing credential as "authentication error: chainloop is not authenticated; run 'chainloop config save' first: rpc error: ..." while `chainloop workflow list` reported the same condition as `authentication required, please run "chainloop auth login"`. The mapping in main.go matched on the gRPC status message, which grpc rewrites with the whole error chain as soon as the error is wrapped, so the trace path never matched and fell through to the generic branch. The advice was wrong too: `config save` sets the endpoint, not the credentials. The mapping now lives in action.AuthErrorMessage, which digs the status out of a wrapped error, and is the only place that renders a credential problem: the top-level handler uses it, and so does `trace run`, which logs the failure rather than returning it. Also addresses the review of the previous commit: - `trace run` fails instead of warning when a contract named with --contract cannot be attached, since the attestation path carries no contract name and would silently bind the default one. - .chainloop.yml keeps the indentation width it already uses instead of being rewritten with two spaces. - The formatting test uses a non-alphabetical fixture and compares the whole file, so a map round-trip cannot pass unnoticed. - Shorter command help; the flag descriptions carry the details. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: 90463ef4-5d43-4c6b-8369-d85c131c0ba8 Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
The four user-visible strings were written out nine times across three tests. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: 90463ef4-5d43-4c6b-8369-d85c131c0ba8
jiparis
approved these changes
Sep 8, 2026
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 14 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
chainloop trace initandchainloop trace runnow create the Chainloop workflow the trace attestations target, attached to thechainloop-ai-coding-sessionworkflow contract when the organization has it, and to the control plane's default contract otherwise.Until now the workflow was created implicitly by the pre-push hook, always with an empty per-project contract and with nobody reading the output, so traced AI coding sessions were never governed by a contract.
--contractflag ontrace initandtrace runoverrides the contract name. It is used only when the workflow is created and is not persisted to.chainloop.yml, so the push path stays unchanged.--contractmust exist.trace initis a no-op for the workflow.trace initfails before writing hooks or.chainloop.ymlwhen the workflow cannot be created.trace runonly warns and runs the session anyway, since the attestation still creates the workflow..chainloop.ymlnow preserves the user's comments, key order and indentation instead of re-marshalling the file from a map.No control-plane or API change. One integration test case pins the behaviour trace relies on: an organization-level contract can be attached while the project is still being created.
Closes #3416
AI assistance
This change was produced with AI assistance (Claude Code); every commit carries an
Assisted-by: Claude Codetrailer.🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri