fix(renderer): backfill skipped/passed counts for pre-existing attestations

Attestations signed before the skipped/passed counters were added to the
predicate decode them as zero. When inline evaluations are available,
recompute at describe time so DerivePolicyStatusSummary doesn't
misclassify skipped-only runs as PASSED.

Identified by cubic.

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

pkg/attestation/renderer/chainloop/v02.go

@@ -476,6 +476,22 @@ func (p *ProvenancePredicateV02) GetPolicyEvaluationsRef() *intoto.ResourceDescr
 }
 
 func (p *ProvenancePredicateV02) GetPolicyEvaluationStatus() *PolicyEvaluationStatus {
+	skipped, passed := p.PolicySkippedCount, p.PolicyPassedCount
+	// Attestations signed before the skipped/passed counters were added to
+	// the predicate decode them as zero. When the inline evaluations are
+	// available, recompute to keep the canonical PolicyStatus derivation
+	// correct for historic envelopes (e.g. skipped-only runs would otherwise
+	// be misclassified as PASSED).
+	if skipped == 0 && passed == 0 && p.PolicyEvaluationsCount > 0 {
+		evals := p.PolicyEvaluations
+		if len(evals) == 0 {
+			evals = p.PolicyEvaluationsFallback
+		}
+		if len(evals) > 0 {
+			skipped, passed = countSkippedAndPassed(evals)
+		}
+	}
+
 	return &PolicyEvaluationStatus{
 		Strategy:           p.PolicyCheckBlockingStrategy,
 		Bypassed:           p.PolicyBlockBypassEnabled,
@@ -484,9 +500,25 @@ func (p *ProvenancePredicateV02) GetPolicyEvaluationStatus() *PolicyEvaluationSt
 		HasGatedViolations: p.PolicyHasGatedViolations,
 		EvaluationsCount:   p.PolicyEvaluationsCount,
 		ViolationsCount:    p.PolicyViolationsCount,
-		SkippedCount:       p.PolicySkippedCount,
-		PassedCount:        p.PolicyPassedCount,
+		SkippedCount:       skipped,
+		PassedCount:        passed,
+	}
+}
+
+func countSkippedAndPassed(evals map[string][]*PolicyEvaluation) (skipped, passed int) {
+	for _, list := range evals {
+		for _, ev := range list {
+			switch {
+			case len(ev.Violations) > 0:
+				// violation-bearing evaluations are neither passed nor skipped
+			case ev.Skipped:
+				skipped++
+			default:
+				passed++
+			}
+		}
 	}
+	return
 }
 
 // Translate a ResourceDescriptor to a NormalizedMaterial

pkg/attestation/renderer/chainloop/v02_test.go

@@ -710,6 +710,49 @@ func TestPolicyEvaluationStatusCounts(t *testing.T) {
 	assert.True(t, status.HasViolations)
 }
 
+// Attestations predating the skipped/passed counters must still surface them
+// correctly at describe time — otherwise a run where every evaluation was
+// skipped would be misclassified as PASSED by DerivePolicyStatusSummary.
+func TestPolicyEvaluationStatusBackfill(t *testing.T) {
+	evals := map[string][]*PolicyEvaluation{
+		"material-a": {
+			{Skipped: true},
+			{Skipped: true},
+		},
+		"material-b": {
+			{}, // passed
+			{Violations: []*PolicyViolation{{Message: "boom"}}},
+		},
+	}
+	p := &ProvenancePredicateV02{
+		PolicyEvaluations:      evals,
+		PolicyEvaluationsCount: 4,
+		PolicyViolationsCount:  1,
+		PolicyHasViolations:    true,
+	}
+
+	status := p.GetPolicyEvaluationStatus()
+	assert.Equal(t, 2, status.SkippedCount)
+	assert.Equal(t, 1, status.PassedCount)
+}
+
+// When the predicate already carries counters, the inline evaluations are
+// ignored — the stored values are authoritative for new attestations.
+func TestPolicyEvaluationStatusDoesNotOverrideStoredCounters(t *testing.T) {
+	p := &ProvenancePredicateV02{
+		PolicyEvaluations: map[string][]*PolicyEvaluation{
+			"m": {{Skipped: true}},
+		},
+		PolicyEvaluationsCount: 3,
+		PolicySkippedCount:     0,
+		PolicyPassedCount:      3,
+	}
+
+	status := p.GetPolicyEvaluationStatus()
+	assert.Equal(t, 0, status.SkippedCount)
+	assert.Equal(t, 3, status.PassedCount)
+}
+
 func TestPolicyEvaluationsField(t *testing.T) {
 	raw, err := os.ReadFile("testdata/attestation-pe-snake.json")
 	require.NoError(t, err)