refactor: extract cache wrapper types into pkg/cache sub-packages

Move AttestationBundleCache and policy eval bundle cache types into
their own packages (pkg/cache/attestationbundle and
pkg/cache/policyevalbundle) so they can be initialized outside of
the controlplane. Each package provides a Cache wrapper type, a New
constructor, and default constants for TTL, bucket name, and
description.

Signed-off-by: Miguel Martinez Trivino <migmartri@gmail.com>
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

app/controlplane/cmd/wire.go

@@ -38,6 +38,8 @@ import (
 	"github.com/chainloop-dev/chainloop/app/controlplane/plugins/sdk/v1"
 	"github.com/chainloop-dev/chainloop/pkg/blobmanager/loader"
 	"github.com/chainloop-dev/chainloop/pkg/cache"
+	"github.com/chainloop-dev/chainloop/pkg/cache/attestationbundle"
+	"github.com/chainloop-dev/chainloop/pkg/cache/policyevalbundle"
 	"github.com/chainloop-dev/chainloop/pkg/credentials"
 	"github.com/chainloop-dev/chainloop/pkg/natsconn"
 	"github.com/go-kratos/kratos/v2/log"
@@ -170,34 +172,12 @@ func newMembershipsCache(ctx context.Context, rc *natsconn.ReloadableConnection,
 	return cache.New[*entities.Membership](opts...)
 }
 
-func newPolicyEvalBundleCache(ctx context.Context, rc *natsconn.ReloadableConnection, logger log.Logger) (cache.Cache[[]byte], error) {
-	l := log.NewHelper(logger)
-	backend := "memory"
-	opts := []cache.Option{cache.WithTTL(24 * time.Hour), cache.WithLogger(&kratosLogAdapter{h: l}), cache.WithDescription("Cache for policy evaluation bundles from CAS")}
-	if rc != nil {
-		backend = "nats"
-		opts = append(opts, cache.WithNATS(rc.Conn, "chainloop-policy-eval-bundles"))
-		opts = append(opts, cache.WithReconnect(rc.Subscribe(ctx)))
-	}
-	l.Infow("msg", "cache initialized", "bucket", "chainloop-policy-eval-bundles", "backend", backend, "ttl", "24h")
-	return cache.New[[]byte](opts...)
+func newPolicyEvalBundleCache(ctx context.Context, rc *natsconn.ReloadableConnection, logger log.Logger) (*policyevalbundle.Cache, error) {
+	return policyevalbundle.New(ctx, rc, logger)
 }
 
-func newAttestationBundleCache(ctx context.Context, rc *natsconn.ReloadableConnection, logger log.Logger) (*biz.AttestationBundleCache, error) {
-	l := log.NewHelper(logger)
-	backend := "memory"
-	opts := []cache.Option{cache.WithTTL(5 * 24 * time.Hour), cache.WithLogger(&kratosLogAdapter{h: l}), cache.WithDescription("Cache for attestation bundles")}
-	if rc != nil {
-		backend = "nats"
-		opts = append(opts, cache.WithNATS(rc.Conn, "chainloop-attestation-bundles"))
-		opts = append(opts, cache.WithReconnect(rc.Subscribe(ctx)))
-	}
-	l.Infow("msg", "cache initialized", "bucket", "chainloop-attestation-bundles", "backend", backend, "ttl", "120h")
-	c, err := cache.New[[]byte](opts...)
-	if err != nil {
-		return nil, err
-	}
-	return &biz.AttestationBundleCache{Cache: c}, nil
+func newAttestationBundleCache(ctx context.Context, rc *natsconn.ReloadableConnection, logger log.Logger) (*attestationbundle.Cache, error) {
+	return attestationbundle.New(ctx, rc, logger)
 }
 
 // kratosLogAdapter adapts kratos log.Helper (Debugw(...interface{})) to cache.Logger (Debugw(string, ...any)).

app/controlplane/cmd/wire_gen.go

@@ -27,7 +27,7 @@ import (
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/biz"
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/pagination"
 	chainloop "github.com/chainloop-dev/chainloop/pkg/attestation/renderer/chainloop"
-	"github.com/chainloop-dev/chainloop/pkg/cache"
+	"github.com/chainloop-dev/chainloop/pkg/cache/policyevalbundle"
 	"github.com/chainloop-dev/chainloop/pkg/credentials"
 	errors "github.com/go-kratos/kratos/v2/errors"
 	"github.com/google/uuid"
@@ -46,7 +46,7 @@ type WorkflowRunService struct {
 	credsReader             credentials.Reader
 	casClient               biz.CASClient
 	casMappingUC            *biz.CASMappingUseCase
-	policyEvalCache         cache.Cache[[]byte]
+	policyEvalCache         *policyevalbundle.Cache
 }
 
 type NewWorkflowRunServiceOpts struct {
@@ -57,7 +57,7 @@ type NewWorkflowRunServiceOpts struct {
 	CredsReader        credentials.Reader
 	CASClient          biz.CASClient
 	CASMappingUC       *biz.CASMappingUseCase
-	PolicyEvalCache    cache.Cache[[]byte]
+	PolicyEvalCache    *policyevalbundle.Cache
 	Opts               []NewOpt
 }
 

app/controlplane/internal/service/workflowrun.go

@@ -35,6 +35,7 @@ import (
 	"github.com/chainloop-dev/chainloop/app/controlplane/plugins/sdk/v1"
 	robotaccount "github.com/chainloop-dev/chainloop/internal/robotaccount/cas"
 	backends "github.com/chainloop-dev/chainloop/pkg/blobmanager"
+	"github.com/chainloop-dev/chainloop/pkg/cache/attestationbundle"
 	"github.com/chainloop-dev/chainloop/pkg/credentials"
 	"github.com/chainloop-dev/chainloop/pkg/natsconn"
 	"github.com/go-kratos/kratos/v2/log"
@@ -71,7 +72,7 @@ func WireTestData(context.Context, *TestDatabase, *testing.T, log.Logger, creden
 	)
 }
 
-func newAttestationBundleCache() *biz.AttestationBundleCache {
+func newAttestationBundleCache() *attestationbundle.Cache {
 	return nil
 }
 

app/controlplane/pkg/biz/testhelpers/wire.go

@@ -30,7 +30,7 @@ import (
 	"github.com/chainloop-dev/chainloop/pkg/attestation"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer/chainloop"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/verifier"
-	"github.com/chainloop-dev/chainloop/pkg/cache"
+	"github.com/chainloop-dev/chainloop/pkg/cache/attestationbundle"
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
 	protobundle "github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
@@ -104,20 +104,14 @@ type WorkflowRunRepo interface {
 	Expire(ctx context.Context, id uuid.UUID) error
 }
 
-// AttestationBundleCache wraps cache.Cache[[]byte] to disambiguate from other
-// []byte caches (e.g. policy evaluation bundles) in the wire dependency graph.
-type AttestationBundleCache struct {
-	cache.Cache[[]byte]
-}
-
 type WorkflowRunUseCase struct {
 	wfRunRepo WorkflowRunRepo
 	wfRepo    WorkflowRepo
 	logger    *log.Helper
 	auditorUC *AuditorUseCase
 
 	signingUseCase *SigningUseCase
-	bundleCache    *AttestationBundleCache
+	bundleCache    *attestationbundle.Cache
 	casClient      CASClient
 	casMappingUC   *CASMappingUseCase
 }
@@ -128,7 +122,7 @@ type WorkflowRunUseCaseOpts struct {
 	SigningUC    *SigningUseCase
 	AuditorUC    *AuditorUseCase
 	Logger       log.Logger
-	BundleCache  *AttestationBundleCache
+	BundleCache  *attestationbundle.Cache
 	CASClient    CASClient
 	CASMappingUC *CASMappingUseCase
 }

app/controlplane/pkg/biz/testhelpers/wire_gen.go

@@ -0,0 +1,76 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package attestationbundle provides a typed cache for attestation bundles.
+package attestationbundle
+
+import (
+	"context"
+	"time"
+
+	"github.com/chainloop-dev/chainloop/pkg/cache"
+	"github.com/chainloop-dev/chainloop/pkg/natsconn"
+	"github.com/go-kratos/kratos/v2/log"
+)
+
+const (
+	ttl         = 5 * 24 * time.Hour
+	bucket      = "chainloop-attestation-bundles"
+	description = "Cache for attestation bundles"
+)
+
+// Cache wraps cache.Cache[[]byte] to provide a distinct type for wire disambiguation.
+type Cache struct {
+	cache.Cache[[]byte]
+}
+
+// New creates an attestation bundle cache with built-in TTL, bucket, and description.
+func New(ctx context.Context, rc *natsconn.ReloadableConnection, logger log.Logger) (*Cache, error) {
+	opts := []cache.Option{
+		cache.WithTTL(ttl),
+		cache.WithDescription(description),
+	}
+
+	if logger != nil {
+		opts = append(opts, cache.WithLogger(&kratosLogAdapter{h: log.NewHelper(logger)}))
+	}
+
+	if rc != nil {
+		opts = append(opts, cache.WithNATS(rc.Conn, bucket))
+		opts = append(opts, cache.WithReconnect(rc.Subscribe(ctx)))
+	}
+
+	c, err := cache.New[[]byte](opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &Cache{Cache: c}, nil
+}
+
+// kratosLogAdapter adapts kratos log.Helper to cache.Logger.
+type kratosLogAdapter struct{ h *log.Helper }
+
+func (a *kratosLogAdapter) Debugw(msg string, keyvals ...any) {
+	a.h.Debugw(append([]any{"msg", msg}, keyvals...)...)
+}
+func (a *kratosLogAdapter) Infow(msg string, keyvals ...any) {
+	a.h.Infow(append([]any{"msg", msg}, keyvals...)...)
+}
+func (a *kratosLogAdapter) Warnw(msg string, keyvals ...any) {
+	a.h.Warnw(append([]any{"msg", msg}, keyvals...)...)
+}
+func (a *kratosLogAdapter) Errorw(msg string, keyvals ...any) {
+	a.h.Errorw(append([]any{"msg", msg}, keyvals...)...)
+}