fix(policies): graceful degradation when policy uses undefined builtin

When a Rego policy references a custom builtin function that the current
CLI doesn't have registered (e.g. chainloop.vulnerability on an older
client), OPA rejects the policy at compile time with rego_type_error.

Instead of hard-failing the entire attestation, catch undefined function
errors and degrade the policy evaluation to skipped with a descriptive
reason prompting the user to upgrade.

Closes #2979

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

pkg/policies/policies.go

@@ -591,12 +591,31 @@ func (pv *PolicyVerifier) executeScript(ctx context.Context, script *engine.Poli
 	// Execute using the selected engine
 	res, err := policyEngine.Verify(ctx, script, material, argsAny)
 	if err != nil {
+		// Gracefully degrade when a policy references a builtin function that this
+		// client version doesn't have registered (e.g., chainloop.vulnerability on an
+		// older CLI). Mark as skipped so the attestation can proceed.
+		if isUndefinedBuiltinError(err) {
+			pv.logger.Warn().Str("policy", script.Name).Err(err).
+				Msg("policy uses an unsupported builtin function, skipping — upgrade your client")
+			return &engine.EvaluationResult{
+				Skipped:    true,
+				SkipReason: fmt.Sprintf("unsupported builtin function (upgrade your client): %s", err),
+				Violations: make([]*engine.PolicyViolation, 0),
+			}, nil
+		}
 		return nil, fmt.Errorf("failed to execute policy: %w", err)
 	}
 
 	return res, nil
 }
 
+// isUndefinedBuiltinError returns true if the error is an OPA type error
+// caused by an undefined function, which typically means the client doesn't
+// have a required custom builtin registered.
+func isUndefinedBuiltinError(err error) bool {
+	return strings.Contains(err.Error(), "rego_type_error: undefined function")
+}
+
 // LoadPolicySpec loads and validates a policy spec from a contract
 func (pv *PolicyVerifier) loadPolicySpec(ctx context.Context, attachment *v1.PolicyAttachment) (*v1.Policy, *PolicyDescriptor, error) {
 	loader, err := pv.getLoader(attachment)

pkg/policies/policies_test.go

@@ -17,6 +17,7 @@ package policies
 
 import (
 	"context"
+	"fmt"
 	"io/fs"
 	"os"
 	"testing"
@@ -1361,6 +1362,73 @@ func (s *testSuite) TestShouldEvaluateAtPhase() {
 	}
 }
 
+func (s *testSuite) TestUndefinedBuiltinGracefulDegradation() {
+	content, err := os.ReadFile("testdata/sbom-spdx.json")
+	s.Require().NoError(err)
+
+	schema := &v12.CraftingSchema{
+		Policies: &v12.Policies{
+			Materials: []*v12.PolicyAttachment{
+				{
+					Policy: &v12.PolicyAttachment_Ref{Ref: "file://testdata/policy_undefined_builtin.yaml"},
+				},
+			},
+		},
+	}
+	material := &v1.Attestation_Material{
+		M: &v1.Attestation_Material_Artifact_{Artifact: &v1.Attestation_Material_Artifact{
+			Content: content,
+		}},
+		MaterialType: v12.CraftingSchema_Material_SBOM_SPDX_JSON,
+		InlineCas:    true,
+	}
+
+	verifier := NewPolicyVerifier(schema.Policies, nil, &s.logger)
+
+	res, err := verifier.VerifyMaterial(context.TODO(), material, "")
+	s.Require().NoError(err, "undefined builtin should not cause a hard error")
+	s.Require().Len(res, 1)
+	s.True(res[0].Skipped, "policy should be marked as skipped")
+	s.Require().Len(res[0].SkipReasons, 1)
+	s.Contains(res[0].SkipReasons[0], "unsupported builtin function")
+	s.Empty(res[0].Violations, "skipped policy should have no violations")
+}
+
+func (s *testSuite) TestIsUndefinedBuiltinError() {
+	cases := []struct {
+		name   string
+		err    error
+		expect bool
+	}{
+		{
+			name:   "undefined function error",
+			err:    fmt.Errorf("failed to evaluate policy: 1 error occurred: vulnerabilities:115: rego_type_error: undefined function chainloop.vulnerability"),
+			expect: true,
+		},
+		{
+			name:   "wrapped undefined function error",
+			err:    fmt.Errorf("failed to execute policy: %w", fmt.Errorf("rego_type_error: undefined function chainloop.nonexistent")),
+			expect: true,
+		},
+		{
+			name:   "regular evaluation error",
+			err:    fmt.Errorf("failed to evaluate policy: some other error"),
+			expect: false,
+		},
+		{
+			name:   "syntax error",
+			err:    fmt.Errorf("rego_parse_error: unexpected token"),
+			expect: false,
+		},
+	}
+
+	for _, tc := range cases {
+		s.Run(tc.name, func() {
+			s.Equal(tc.expect, isUndefinedBuiltinError(tc.err))
+		})
+	}
+}
+
 type testSuite struct {
 	suite.Suite
 

pkg/policies/testdata/policy_undefined_builtin.rego

@@ -0,0 +1,26 @@
+package main
+
+import rego.v1
+
+result := {
+    "skipped": skipped,
+    "violations": violations,
+    "skip_reason": skip_reason,
+}
+
+default skip_reason := ""
+
+skip_reason := m if {
+    not valid_input
+    m := "invalid input"
+}
+
+default skipped := true
+
+skipped := false if valid_input
+
+valid_input := true
+
+violations contains v if {
+    v := chainloop.nonexistent("test")
+}

pkg/policies/testdata/policy_undefined_builtin.yaml

@@ -0,0 +1,8 @@
+apiVersion: chainloop.dev/v1
+kind: Policy
+metadata:
+  name: undefined-builtin
+  description: Test policy that uses an undefined builtin function
+spec:
+  type: SBOM_SPDX_JSON
+  path: policy_undefined_builtin.rego