feat(attestation): add optional location field to PolicyVulnerabilityFinding

app/cli/cmd/workflow_workflow_run_describe.go

@@ -368,9 +368,9 @@ func downloadPolicyEvaluationsHint(ref *action.PolicyEvaluationsRef) string {
 }
 
 // violationSummary builds a single-line description of a violation using the
-// structured finding when present (CVE id + severity + package + fix info,
-// or SAST rule + location, or license + component). Falls back to the first
-// line of Message — vuln policies emit a multi-line markdown report there
+// structured finding when present (CVE id + severity + package + location +
+// fix info, or SAST rule + location, or license + component). Falls back to
+// the first line of Message — vuln policies emit a multi-line markdown report there
 // which would otherwise break the row layout. The resolved assessment
 // status, if any, is appended inside the same severity-parens regardless
 // of suppression so AFFECTED / UNDER_INVESTIGATION / etc. surface on
@@ -391,6 +391,11 @@ func violationSummary(v *action.PolicyViolation) string {
 		if pkg := prettyPurl(f.GetPackagePurl()); pkg != "" {
 			head += " " + pkg
 		}
+		// Only set when the policy reports per-copy findings; it is what tells
+		// two findings for the same package in the same artifact apart.
+		if loc := f.GetLocation(); loc != "" {
+			head += " at " + loc
+		}
 		if fix := f.GetFixedVersion(); fix != "" {
 			head += " [fix: " + fix + "]"
 		}

app/cli/cmd/workflow_workflow_run_describe_test.go

@@ -80,6 +80,19 @@ func TestViolationSummary(t *testing.T) {
 			},
 			want: "CVE-2024-9999 (HIGH) lib@v1.0.0 [fix: 1.0.1]",
 		},
+		{
+			name: "vulnerability with location",
+			violation: &action.PolicyViolation{
+				Vulnerability: &attv1.PolicyVulnerabilityFinding{
+					ExternalId:   "CVE-2024-9999",
+					Severity:     "high",
+					PackagePurl:  "pkg:maven/com.example/lib@1.0.0",
+					Location:     "/opt/app/lib/ext/lib-1.0.0.jar",
+					FixedVersion: "1.0.1",
+				},
+			},
+			want: "CVE-2024-9999 (HIGH) lib@1.0.0 at /opt/app/lib/ext/lib-1.0.0.jar [fix: 1.0.1]",
+		},
 		{
 			name: "active vulnerability surfaces assessment status (AFFECTED)",
 			violation: &action.PolicyViolation{

pkg/attestation/crafter/api/attestation/v1/crafting_state.proto

@@ -355,6 +355,11 @@ message PolicyVulnerabilityFinding {
   string fixed_version = 9;
   // Optional assessment context. See PolicyAssessmentResult.
   optional PolicyAssessmentResult assessment = 10;
+  // Optional location of the affected component copy — a file path
+  // (e.g., "/opt/app/lib/ext/lib-1.2.3.jar") or, when no path is available,
+  // the SBOM component reference. Distinguishes multiple copies of the same
+  // package within a single artifact.
+  string location = 11;
 }
 
 // Output schema for SAST findings from policy evaluation.

pkg/policies/engine/rego/builtins/vulnerability_test.go

@@ -77,6 +77,23 @@ result := object.union(
 				"fixed_version": "1.0.1",
 			},
 		},
+		{
+			name: "combined with object.union for location",
+			policy: `package test
+import rego.v1
+
+result := object.union(
+	chainloop.vulnerability("CVE found", "CVE-2024-5678", "pkg:maven/com.example/lib@1.0.0", "HIGH"),
+	{"location": "/opt/app/lib/ext/lib-1.0.0.jar"},
+)`,
+			expected: map[string]any{
+				"message":      "CVE found",
+				"external_id":  "CVE-2024-5678",
+				"package_purl": "pkg:maven/com.example/lib@1.0.0",
+				"severity":     "HIGH",
+				"location":     "/opt/app/lib/ext/lib-1.0.0.jar",
+			},
+		},
 		{
 			name: "with sprintf interpolation",
 			policy: `package test

pkg/policies/findings/registry_test.go

@@ -115,6 +115,27 @@ func TestValidateFinding(t *testing.T) {
 				assert.Equal(t, "1.0.1", f.GetFixedVersion())
 			},
 		},
+		{
+			name:        "valid vulnerability finding with location",
+			findingType: "VULNERABILITY",
+			raw: map[string]any{
+				"message":      "Found CVE-2024-5678",
+				"external_id":  "CVE-2024-5678",
+				"package_purl": "pkg:maven/com.example/lib@1.0.0",
+				"severity":     "HIGH",
+				"location":     "/opt/app/lib/ext/lib-1.0.0.jar",
+			},
+			checkFn: func(t *testing.T, msg interface{}) {
+				t.Helper()
+				f, ok := msg.(*v1.PolicyVulnerabilityFinding)
+				require.True(t, ok)
+				assert.Equal(t, "Found CVE-2024-5678", f.GetMessage())
+				assert.Equal(t, "CVE-2024-5678", f.GetExternalId())
+				assert.Equal(t, "pkg:maven/com.example/lib@1.0.0", f.GetPackagePurl())
+				assert.Equal(t, "HIGH", f.GetSeverity())
+				assert.Equal(t, "/opt/app/lib/ext/lib-1.0.0.jar", f.GetLocation())
+			},
+		},
 		{
 			name:        "vulnerability finding missing required field",
 			findingType: "VULNERABILITY",