fix(annotations): allow hyphens in annotation names

[yunaremaia]

Summary

• Widens the validation regex for Annotation.name from ^\w+$ to ^\w-$ so hyphenated names like my-annotation are accepted
• Regenerates protobuf code (Go), TypeScript definitions, and JSON Schema from the updated proto
• Adds documentation note about Go template index function syntax for hyphenated annotation access

Context

Fixes #3405 — annotation names with hyphens were rejected by validation.

Test plan

• Unit tests updated to cover hyphenated annotation names
• Protobuf regeneration verified (Go, TypeScript, JSON Schema)
• CI checks pass (block/protoc version compatibility)

Notes

Regenerates 33 files (mostly auto-generated protobuf artifacts). The source change is a 1-line regex widen in the proto definition + documentation.

[chainloop-platform]

Security Checks — ⚠️ 2 failing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

⚠️ iac-scan — 1 failing

Status	Policy	Messages
⚠️ Failed	iac-misconfiguration	Ensure that arrays have a maximum number of items in "app/controlplane/api/gen/temp-openapi/apidocs.swagger.json" (error)

PR info

Status	Policy	Messages
⚠️ Failed	pr-min-approvals	PR/MR #3441 has 0 approving reviews, 1 required.
✅ Passed	pr-description-required	-
✅ Passed	pr-user-story-linked	-

⏭️ 2 scans not applied

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

View attestation ↗

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

1 issue found across 33 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/controlplane/api/workflowcontract/v1/crafting_schema.proto">

<violation number="1" location="app/controlplane/api/workflowcontract/v1/crafting_schema.proto:249">
P2: The new pattern ^[\w-]+$ accepts names made only of hyphens ("-", "--"), and names with leading, trailing, or consecutive hyphens ("-foo", "foo-", "foo--bar"), which contradicts the comment's stated intent of words optionally separated by _ or -. Restrict hyphens to separators between word characters.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The new pattern ^[\w-]+$ accepts names made only of hyphens ("-", "--"), and names with leading, trailing, or consecutive hyphens ("-foo", "foo-", "foo--bar"), which contradicts the comment's stated intent of words optionally separated by _ or -. Restrict hyphens to separators between word characters.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At app/controlplane/api/workflowcontract/v1/crafting_schema.proto, line 249:

<comment>The new pattern ^[\w-]+$ accepts names made only of hyphens ("-", "--"), and names with leading, trailing, or consecutive hyphens ("-foo", "foo-", "foo--bar"), which contradicts the comment's stated intent of words optionally separated by _ or -. Restrict hyphens to separators between word characters.</comment>

<file context>
@@ -241,7 +241,12 @@ message CraftingSchemaV2Spec {
+  // function syntax in Go template consumers like Dependency-Track:
+  //   {{ index .Material.Annotations "my-annotation" }}
+  // rather than direct field access {{ .Material.Annotations.my-annotation }}.
+  string name = 1 [(buf.validate.field).string.pattern = "^[\\w-]+$"];
   // This value can be set in the contract or provided during the attestation
   string value = 2;
</file context>