feat(materials): add TruffleHog and Cobertura material types

app/cli/documentation/cli-reference.mdx

@@ -262,7 +262,7 @@ Options
 --annotation strings                   additional annotation in the format of key=value
 --attestation-id string                Unique identifier of the in-progress attestation
 -h, --help                                 help for add
---kind string                          kind of the material to be recorded: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CERTCC_DRANZER" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "OSSF_SCORECARD_JSON" "RADAMSA_CRASHES" "RADAMSA_REPORT" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "SYSINTERNALS_ACCESSCHK" "SYSINTERNALS_SIGCHECK" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
+--kind string                          kind of the material to be recorded: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CERTCC_DRANZER" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "COBERTURA_XML" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "OSSF_SCORECARD_JSON" "RADAMSA_CRASHES" "RADAMSA_REPORT" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "SYSINTERNALS_ACCESSCHK" "SYSINTERNALS_SIGCHECK" "TRUFFLEHOG_JSON" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
 --max-extract-entries int              max number of files to extract when --value is an archive (default 10000)
 --max-extract-size string              max total uncompressed size to extract when --value is an archive (default "1GiB")
 --name string                          name of the material as shown in the contract
@@ -3038,7 +3038,7 @@ Options
 --annotation strings          Key-value pairs of material annotations (key=value)
 -h, --help                        help for eval
 --input stringArray           Key-value pairs of policy inputs (key=value)
---kind string                 Kind of the material: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CERTCC_DRANZER" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "OSSF_SCORECARD_JSON" "RADAMSA_CRASHES" "RADAMSA_REPORT" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "SYSINTERNALS_ACCESSCHK" "SYSINTERNALS_SIGCHECK" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
+--kind string                 Kind of the material: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CERTCC_DRANZER" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "COBERTURA_XML" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "OSSF_SCORECARD_JSON" "RADAMSA_CRASHES" "RADAMSA_REPORT" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "SYSINTERNALS_ACCESSCHK" "SYSINTERNALS_SIGCHECK" "TRUFFLEHOG_JSON" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
 --material string             Path to material or attestation file
 -p, --policy string               Policy reference (./my-policy.yaml, https://my-domain.com/my-policy.yaml, chainloop://my-stored-policy) (default "policy.yaml")
 --project string              Project name to use as engine context for chainloop.* built-ins

app/controlplane/api/workflowcontract/v1/crafting_schema.proto

@@ -188,6 +188,12 @@ message CraftingSchema {
       RADAMSA_REPORT = 38;
       // radamsa crashing inputs, a single file or a crashes/ archive (tar.gz or zip)
       RADAMSA_CRASHES = 39;
+      // TruffleHog secret scanning report in JSONL format (one JSON finding per line)
+      // https://github.com/trufflesecurity/trufflehog
+      TRUFFLEHOG_JSON = 40;
+      // Cobertura code coverage report in XML format
+      // https://github.com/cobertura/cobertura
+      COBERTURA_XML = 41;
     }
   }
 }

app/controlplane/api/workflowcontract/v1/crafting_schema_validations.go

@@ -48,6 +48,7 @@ var CraftingMaterialInValidationOrder = []CraftingSchema_Material_MaterialType{
 	CraftingSchema_Material_GRAPHQL_SPEC,
 	CraftingSchema_Material_JUNIT_XML,
 	CraftingSchema_Material_JACOCO_XML,
+	CraftingSchema_Material_COBERTURA_XML,
 	// NOTE: RADAMSA_REPORT and RADAMSA_CRASHES are intentionally omitted from
 	// auto-detection. RADAMSA_CRASHES single-file mode accepts almost any
 	// non-empty file and would eagerly shadow other types; both work fine when

pkg/attestation/crafter/api/attestation/v1/crafting_state.go

@@ -27,10 +27,12 @@ import (
 	v1 "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/accesschk"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/attestation"
+	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/cobertura"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/dranzer"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/jacoco"
 	materialsjunit "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/junit"
 	materialsradamsa "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/radamsa"
+	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/trufflehog"
 	"github.com/chainloop-dev/chainloop/pkg/tabular"
 	intoto "github.com/in-toto/attestation/go/v1"
 	"google.golang.org/protobuf/types/known/structpb"
@@ -193,6 +195,15 @@ func (m *Attestation_Material) ingestMaterialToJSON(rawMaterial []byte, value st
 			return nil, fmt.Errorf("invalid radamsa -M metadata log: %w", err)
 		}
 		return json.Marshal(records)
+	case v1.CraftingSchema_Material_TRUFFLEHOG_JSON:
+		// TruffleHog --json output is JSONL (one finding per line), not a JSON
+		// array; render it as a JSON array so the policy engine exposes the
+		// findings as input.elements.
+		findings, err := trufflehog.Parse(bytes.NewReader(rawMaterial))
+		if err != nil {
+			return nil, fmt.Errorf("invalid trufflehog report: %w", err)
+		}
+		return json.Marshal(findings)
 	case v1.CraftingSchema_Material_RADAMSA_CRASHES:
 		// metadata-only: the crash content (single binary file or archive) is
 		// never evaluated. Discard it so inline content is not parsed as JSON;
@@ -204,6 +215,12 @@ func (m *Attestation_Material) ingestMaterialToJSON(rawMaterial []byte, value st
 			return nil, fmt.Errorf("invalid Jacoco report file: %w", err)
 		}
 		return json.Marshal(&report)
+	case v1.CraftingSchema_Material_COBERTURA_XML:
+		var report cobertura.Coverage
+		if err := xml.Unmarshal(rawMaterial, &report); err != nil {
+			return nil, fmt.Errorf("invalid Cobertura report file: %w", err)
+		}
+		return json.Marshal(&report)
 	case v1.CraftingSchema_Material_SYSINTERNALS_SIGCHECK:
 		report, err := tabular.Parse(rawMaterial)
 		if err != nil {