Allow PNC SLSA build type for PipelineRun attestations

[vnadempa]

What:

Add a regression test showing that the PNC SLSA v1 build type can be accepted for PipelineRun attestations when it is explicitly provided through rule_data.

The PNC build type is not added to Conforma's global/default provenance allowlist.

Why:

PNC produces SLSA v1 attestations with a PNC-specific buildType. The goal is to verify that Conforma can accept this build type through custom rule_data, without enabling it globally for all Conforma users.

Testing:

• PNC-specific regression test passes.
• Full Conforma test suite: 1071/1071 tests passed.
• make fmt-check passes.
• git diff --check passes.

Related:

This follows the suggestion to use custom rule_data to enable the PNC build type instead of modifying the default provenance allowlist.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:46 AM UTC · Completed 9:58 AM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.44

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1c114e6f-f8ca-4f3b-8fd1-e95d36d1cc9d

📥 Commits

Reviewing files that changed from the base of the PR and between 613785e and 63c2c92.

📒 Files selected for processing (1)

• policy/release/lib/attestations_test.rego

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds a helper and test for recognizing SLSA v1 attestations that use the PNC workflow build type through allowed_provenance_build_types.

Changes

PNC attestation support

Layer / File(s)	Summary
PNC build type attestation test policy/release/lib/attestations_test.rego	Adds a PNC SLSA v1 attestation fixture and verifies that lib.pipelinerun_attestations accepts it when rule_data allows the PNC build type.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 63c2c

The PR adds a localized regression test for custom PNC build-type handling without changing the global allowlist. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: allowing the PNC SLSA build type for PipelineRun attestations.
Description check	✅ Passed	The description explains what changed, why it changed, and how it was tested. It uses a Related section instead of the template's Tickets section, but the required context is present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

Looks good to me