fix(materials): accept GitLab security reports with any observability event

go.mod

@@ -102,7 +102,7 @@ require (
 	github.com/testcontainers/testcontainers-go v0.44.0
 	github.com/vektah/gqlparser/v2 v2.5.60
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78
-	gitlab.com/gitlab-org/security-products/analyzers/report/v5 v5.13.1
+	gitlab.com/gitlab-org/security-products/analyzers/report/v7 v7.3.0
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0
 	go.opentelemetry.io/otel v1.47.0

go.sum

@@ -1342,8 +1342,8 @@ gitlab.com/gitlab-org/api/client-go v1.46.0 h1:YxBWFZIFYKcGESCb9fpkwzouo+apyB9pr
 gitlab.com/gitlab-org/api/client-go v1.46.0/go.mod h1:FtgyU6g2HS5+fMhw6nLK96GBEEBx5MzntOiJWfIaiN8=
 gitlab.com/gitlab-org/security-products/analyzers/common/v3 v3.4.0 h1:+1k1NQiBSVeLDePX82ec3nHdrOsDvhMmA09LL25omTk=
 gitlab.com/gitlab-org/security-products/analyzers/common/v3 v3.4.0/go.mod h1:VEhMaykRqWmiLS7uWGKAVfsFmAqeHp1q1K1s24d37Ig=
-gitlab.com/gitlab-org/security-products/analyzers/report/v5 v5.13.1 h1:936hBRBYfrLjQp5LGrSsP6vet2EawSI1zyUppoHOj/I=
-gitlab.com/gitlab-org/security-products/analyzers/report/v5 v5.13.1/go.mod h1:89AMh07hABjE8V9JFl6UYmjXYaBrsAlQCR7FGWD/aIQ=
+gitlab.com/gitlab-org/security-products/analyzers/report/v7 v7.3.0 h1:jAbRipqripmOdrN3oea0LGkUA48DdzXARNrf3YE7ZrI=
+gitlab.com/gitlab-org/security-products/analyzers/report/v7 v7.3.0/go.mod h1:sSgZy0JXQUfMPPUIdxN7KNNjM6uboLeTnpQAfkDLllU=
 gitlab.com/gitlab-org/security-products/analyzers/ruleset/v3 v3.3.2 h1:dvJgv4yfy+B2DcPtc9cE23sHdm8bcETeprTcD0pHfJA=
 gitlab.com/gitlab-org/security-products/analyzers/ruleset/v3 v3.3.2/go.mod h1:hHFwTR6EqMt2J0b5U18oMxU/yG0h/j7vVboqIszwCrA=
 go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=

pkg/attestation/crafter/materials/gitlab.go

@@ -26,7 +26,7 @@ import (
 	api "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
 	"github.com/chainloop-dev/chainloop/pkg/casclient"
 	"github.com/rs/zerolog"
-	"gitlab.com/gitlab-org/security-products/analyzers/report/v5"
+	"gitlab.com/gitlab-org/security-products/analyzers/report/v7"
 )
 
 var supportedTypes = []string{"sast", "dast", "api_fuzzing", "coverage_fuzzing", "secret_detection", "dependency_scanning", "container_scanning", "container_scanning_for_registry", "cluster_image_scanning"}

pkg/attestation/crafter/materials/gitlab_test.go

@@ -109,6 +109,14 @@ func TestGitlabCrafter_Craft(t *testing.T) {
 				"chainloop.material.tool.version": ":SKIP:",
 			},
 		},
+		{
+			name:     "secret detection report with observability events",
+			filePath: "./testdata/gl-secret-detection-report-observability.json",
+			annotations: map[string]string{
+				"chainloop.material.tool.name":    "Gitleaks",
+				"chainloop.material.tool.version": "8.29.1",
+			},
+		},
 		{
 			name:     "sonarqube report",
 			filePath: "./testdata/gl-sonarqube-report.json",

pkg/attestation/crafter/materials/testdata/gl-secret-detection-report-observability.json

@@ -0,0 +1,71 @@
+{
+  "version": "15.2.4",
+  "vulnerabilities": [
+    {
+      "id": "cc927200-b884-4fb7-8fcc-df8b667404c9",
+      "category": "secret_detection",
+      "name": "Generic API Key",
+      "description": "Generic API Key",
+      "cve": "app/config.yaml:3a3436765885cdf2edc179512c22dd4c4259410f0d18f391cbc8d83a837c678e:generic-api-key",
+      "severity": "Critical",
+      "confidence": "Unknown",
+      "raw_source_code_extract": "example-not-a-real-secret",
+      "scanner": {
+        "id": "gitleaks",
+        "name": "Gitleaks"
+      },
+      "location": {
+        "file": "app/config.yaml",
+        "commit": {
+          "sha": "0000000"
+        },
+        "start_line": 3
+      },
+      "identifiers": [
+        {
+          "type": "gitleaks_rule_id",
+          "name": "Gitleaks rule ID generic-api-key",
+          "value": "generic-api-key"
+        }
+      ]
+    }
+  ],
+  "scan": {
+    "analyzer": {
+      "id": "secrets",
+      "name": "secrets",
+      "url": "https://gitlab.com/gitlab-org/security-products/analyzers/secrets",
+      "vendor": {
+        "name": "GitLab"
+      },
+      "version": "7.24.1"
+    },
+    "scanner": {
+      "id": "gitleaks",
+      "name": "Gitleaks",
+      "url": "https://github.com/gitleaks/gitleaks",
+      "vendor": {
+        "name": "GitLab"
+      },
+      "version": "8.29.1"
+    },
+    "type": "secret_detection",
+    "start_time": "2025-01-01T00:00:00",
+    "end_time": "2025-01-01T00:00:02",
+    "status": "success",
+    "observability": {
+      "events": [
+        {
+          "event": "collect_secrets_analyzer_scan_metrics_from_pipeline",
+          "time_s": 1.5,
+          "exit_code": 0,
+          "bytes_scanned": 2048
+        },
+        {
+          "event": "example_unregistered_event",
+          "value": 1
+        }
+      ]
+    }
+  }
+}