feat(container): surface provenance attestations [PRIM-100] - #7098
Merged
Conversation
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Contributor
|
This comment has been minimized.
This comment has been minimized.
bdemeo12
enabled auto-merge
August 10, 2026 13:38
|
|
||
| // Provenance attestations are gated behind their own feature flag so they can be | ||
| // rolled out independently of the broader "new container facts" flag. | ||
| const PROVENANCE_METADATA_FACT_TYPE = 'provenanceMetadata'; |
Contributor
There was a problem hiding this comment.
Question: This constant seems to be a duplicate to what the snyk-docker-plugin contains, breaking the best practice of single source of truth. wouldn't it be possible to move the filtering into the plugin and hand over the feature flags from the CLI?
Contributor
Author
There was a problem hiding this comment.
Hi Peter! I can do this, but I am blocked by this ask: https://snyksec.atlassian.net/servicedesk/customer/portal/64/CLIA-1576
which is why I implemented it like this!
Contributor
There was a problem hiding this comment.
Questions:
- Is the legacy flow still being used that makes this change necessary?
- What would be the effort to drop the legacy flow?
- I assume the method for feature flag checking is legacy - has it been tested if it is working as expected?
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
This comment has been minimized.
This comment has been minimized.
bdemeo12
changed the title
This comment has been minimized.
This comment has been minimized.
…[PRIM-100] Bump snyk-docker-plugin to ^9.19.0 (adds provenance attestation extraction and the vcs.source fallback for buildConfigSourceUri) and gate the provenanceMetadata fact behind the surfaceProvenanceAttestations feature flag in filterDockerFacts, mirroring the allowNewContainerFacts pattern. Pinned to 9.19.0 rather than 9.20.0 deliberately. 9.20.0 adds a best-effort provenance fetch to the image's registry (snyk/snyk-docker-plugin#891). The plugin handles a failed fetch and the scan completes, but the CLI records the failed request as a command error and appends a second JSON object after the result, which breaks JSON.parse in container.spec.ts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
bdemeo12
force-pushed
the
PRIM-100/cli-provenance-attestations-ff-9.19.0
branch
from
August 13, 2026 17:16
e6545e5 to
0c444b0
Compare
This comment has been minimized.
This comment has been minimized.
Provenance attestations should be surfaced unconditionally, so drop the `surfaceProvenanceAttestations` gating. `shouldFilterFact` is a denylist and `provenanceMetadata` is not in it, so removing the special case is sufficient for the fact to always pass through. Also pins snyk-docker-plugin to exact 9.19.0. `^9.19.0` allows 9.20.x, which reintroduces the double-JSON-output problem (CLIA-1576); the lockfile pinned 9.19.0 so `npm ci` was safe, but a lockfile regeneration would have floated. Exact pinning matches snyk-go-plugin / snyk-gradle-plugin / snyk-module. Reapplies work lost when the branch was force-pushed from a stale local copy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
PR Reviewer Guide 🔍
|
9 tasks
danskmt
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Duplicate of #7047, pinned to snyk-docker-plugin 9.19.0 instead of 9.20.0, rebuilt on current
main.Pull Request Submission Checklist
are release-note ready, emphasizing
what was changed, not how.
What does this PR do?
Surfaces container image provenance attestations through the CLI.
snyk-docker-plugin^9.16.0→^9.19.0, which adds provenance attestation extraction (emits theprovenanceMetadatafact).Where should the reviewer start?
package.json/package-lock.json— bumpsnyk-docker-pluginto^9.19.0.How should this be manually tested?
Point CLI to SDP 9.19.0
What's the product update that needs to be communicated to CLI users?
Upgrade CLI to collect provenance attestation from container scans. Will be included in Container GA announcement.