feat(cli): split policy eval output into violations and findings

Return string violations (what old CLIs see) and structured findings
separately in policy eval output, making it clear what each CLI
version would receive.

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

app/cli/internal/policydevel/eval.go

@@ -49,7 +49,8 @@ type EvalOptions struct {
 }
 
 type EvalResult struct {
-	Violations  []json.RawMessage `json:"violations"`
+	Violations  []string          `json:"violations"`
+	Findings    []json.RawMessage `json:"findings,omitempty"`
 	SkipReasons []string          `json:"skip_reasons"`
 	Skipped     bool              `json:"skipped"`
 }
@@ -134,22 +135,29 @@ func verifyMaterial(pol *v1.Policies, material *v12.Attestation_Material, materi
 		Result: &EvalResult{
 			Skipped:     policyEv.GetSkipped(),
 			SkipReasons: policyEv.SkipReasons,
-			Violations:  make([]json.RawMessage, 0, len(policyEv.Violations)),
+			Violations:  make([]string, 0, len(policyEv.Violations)),
 		},
 	}
 
-	// Marshal violations using protojson to match the attestation storage format.
-	// Subject is cleared since it's redundant in eval context (always the policy name).
+	// Split violations into string messages and structured findings.
+	// "violations" contains the message strings (what old CLIs see).
+	// "findings" contains the full structured data when present.
 	marshaler := protojson.MarshalOptions{UseProtoNames: true}
 	for _, v := range policyEv.Violations {
-		vc := proto.Clone(v).(*v12.PolicyEvaluation_Violation)
-		vc.Subject = ""
+		summary.Result.Violations = append(summary.Result.Violations, v.GetMessage())
 
-		b, err := marshaler.Marshal(vc)
-		if err != nil {
-			return nil, fmt.Errorf("marshaling violation: %w", err)
+		if f := v.GetFinding(); f != nil {
+			// Clone to clear subject before marshaling
+			vc := proto.Clone(v).(*v12.PolicyEvaluation_Violation)
+			vc.Subject = ""
+			vc.Message = ""
+
+			b, err := marshaler.Marshal(vc)
+			if err != nil {
+				return nil, fmt.Errorf("marshaling finding: %w", err)
+			}
+			summary.Result.Findings = append(summary.Result.Findings, b)
 		}
-		summary.Result.Violations = append(summary.Result.Violations, b)
 	}
 
 	// Include raw debug info if requested

app/cli/internal/policydevel/eval_test.go

@@ -149,7 +149,7 @@ func TestEvaluateSimplifiedPolicies(t *testing.T) {
 		assert.Contains(t, string(result.Result.Violations[0]), "at least 2 components")
 	})
 
-	t.Run("violations with finding_type use unified format matching attestation storage", func(t *testing.T) {
+	t.Run("structured findings are returned separately from string violations", func(t *testing.T) {
 		opts := &EvalOptions{
 			PolicyPath:   "testdata/sbom-structured-vuln-policy.yaml",
 			MaterialPath: sbomPath,
@@ -160,23 +160,23 @@ func TestEvaluateSimplifiedPolicies(t *testing.T) {
 		require.NotNil(t, result)
 		assert.False(t, result.Result.Skipped)
 
-		// Single unified violations field with full violation objects (same as attestation)
+		// violations contains string messages
 		require.Len(t, result.Result.Violations, 1)
-
-		var v map[string]any
-		require.NoError(t, json.Unmarshal(result.Result.Violations[0], &v))
-		assert.Nil(t, v["subject"], "subject should be excluded from eval output")
-		assert.Contains(t, v["message"], "Vulnerability found in test-component@1.0.0")
-
-		vuln, ok := v["vulnerability"].(map[string]any)
-		require.True(t, ok, "expected vulnerability finding in violation object")
+		assert.Contains(t, result.Result.Violations[0], "Vulnerability found in test-component@1.0.0")
+
+		// findings contains the structured data
+		require.Len(t, result.Result.Findings, 1)
+		var f map[string]any
+		require.NoError(t, json.Unmarshal(result.Result.Findings[0], &f))
+		vuln, ok := f["vulnerability"].(map[string]any)
+		require.True(t, ok, "expected vulnerability finding")
 		assert.Equal(t, "CVE-2024-1234", vuln["external_id"])
 		assert.Equal(t, "pkg:generic/test-component@1.0.0", vuln["package_purl"])
 		assert.Equal(t, "HIGH", vuln["severity"])
 		assert.InDelta(t, 7.5, vuln["cvss_v3_score"], 0.001)
 	})
 
-	t.Run("violations without finding_type use same unified format", func(t *testing.T) {
+	t.Run("plain string violations have no findings", func(t *testing.T) {
 		opts := &EvalOptions{
 			PolicyPath:   "testdata/sbom-min-components-policy.yaml",
 			MaterialPath: sbomPath,
@@ -186,12 +186,8 @@ func TestEvaluateSimplifiedPolicies(t *testing.T) {
 		require.NoError(t, err)
 		require.NotNil(t, result)
 		require.Len(t, result.Result.Violations, 1)
-
-		// Same structure as attestation: object with message (subject excluded in eval)
-		var v map[string]any
-		require.NoError(t, json.Unmarshal(result.Result.Violations[0], &v))
-		assert.Nil(t, v["subject"], "subject should be excluded from eval output")
-		assert.Contains(t, v["message"], "at least 2 components")
+		assert.Contains(t, result.Result.Violations[0], "at least 2 components")
+		assert.Empty(t, result.Result.Findings)
 	})
 
 	t.Run("sbom metadata component policy", func(t *testing.T) {