Builtin experiments

[simonbaird]

Not sure if we want to merge this or not, but it's interesting to consider.

The idea is that maybe we move all out sigstore signature checks into rego and use ec validate input for everything.

Running the script looks like this:

$ hack/builtin-experiments/demo.sh 

* Input:

image:
  ref: quay.io/redhat-user-workloads/rhtap-contract-tenant/ec-v02/cli-v02:c862b0f77bb10082d1440e0d4b6a4e9645b83382@sha256:9af445f4f79b7f129749e6fffde9a1280c4d260108e9c19545979cee449c00bf

* EC results:

success: true
filepaths:
  - filepath: /dev/fd/63
    violations: []
    warnings: []
    successes:
      - msg: Pass
        metadata:
          code: sigstore.valid
          description: Check image and attestation signatures
          title: Image validation
    success: true
    success-count: 1
policy:
  sources:
    - policy:
        - /home/sbaird/code/ec-cli/hack/builtin-experiments/policy
      data:
        - /home/sbaird/code/ec-cli/hack/builtin-experiments/data
ec-version: v0.3.2701-9b97c6d
effective-time: "2024-03-21T22:21:43.055587461Z"

[simonbaird]

Should rebase on #1462 once that one is merged.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 87.16%. Comparing base (0b70d4f) to head (a93ec19).
Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1463      +/-   ##
==========================================
+ Coverage   80.35%   87.16%   +6.80%     
==========================================
  Files          66       77      +11     
  Lines        4674     5009     +335     
==========================================
+ Hits         3756     4366     +610     
+ Misses        918      643     -275     

Flag	Coverage Δ
acceptance	72.62% <ø> (?)
generative	?
integration	?
unit	80.35% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

see 41 files with indirect coverage changes

[lcarva]

It's an experiment. It's probably worth having it.

[lcarva]

It might be worth adding a comment to explain what this experiment is.

[lcarva]

It would be great to either close this PR or update it so it can be merged.