fix(controlplane): restore PR-mode promotion suppression and auto-repair newest pre-release version

[migmartri]

Summary

PR #3289 removed PR mode's incomplete suppression of latest-version promotion. This PR restores that suppression and completes the behavior in the control plane.

refs #3265

Changes

CLI — restore the PR-mode promotion default

• Restored the PR feat: introduce PR mode for attestations #3268 rule in app/cli/pkg/action/attestation_init.go: when isPR is true, set opts.MarkAsLatest to &false unless the user explicitly passed --mark-latest=true (via the restored explicitMarkAsLatestTrue helper).
• Preserves all three observable states: omitted --mark-latest becomes false in PR mode, explicit --mark-latest=false remains false, explicit --mark-latest=true remains the user override. Non-PR mode leaves the pointer untouched so omitted promotion intent reaches the server as nil.
• Restored the --pr help literal and TestExplicitMarkAsLatestTrue (nil/false/true cases).

Control plane — auto-promote only the newest existing version when intent is omitted

• Refactored the existing-version branch in WorkflowRunRepo.Create to always re-read the target ProjectVersion with ForUpdate inside the transaction.
• Explicit states preserved exactly: true promotes (released versions rejected); false (PR sentinel / explicit opt-out) makes no change.
• New nil path: if the fresh version is active, pre-release, and not already latest, query for any other active version with created_at strictly greater than the target's immutable CreatedAt. If none exists, call promoteVersionToLatestWithTx. A timestamp tie is not "strictly newer", matching the historical ORDER BY project_id, created_at DESC migration.
• Released versions are never auto-promoted. UseLatestVersion and new-version creation are unchanged.

API contract

• Updated the mark_as_latest proto comment to describe the completed nil/true/false semantics; regenerated Go, TypeScript, JSON Schema, and CLI reference artifacts via make generate.

Tests

• Added four integration subtests covering: the repair lifecycle (v1 latest → PR-sim v2 not latest → non-PR v2 repaired to latest with v1 demoted); older version not promoted over newer; explicit-false suppression wins over automatic repair on a newer version; newest released version not auto-promoted.

Verification

• go test ./app/cli/pkg/action -run 'Test(ExplicitMarkAsLatestTrue|ResolvePRMode)$' — PASS
• go test ./app/controlplane/pkg/biz -run 'TestWorkflowRunUseCase/TestCreate' — PASS (all 29 subtests)
• go test ./app/cli/pkg/action/ ./app/controlplane/pkg/data/ ./app/controlplane/pkg/biz/ — PASS
• make generate — generated artifacts consistent, no hand-authored schema changes
• gofmt, go vet, buf lint — clean

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri

[cubic-dev-ai]

1 issue found across 11 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/cli/pkg/action/attestation_init.go">

<violation number="1" location="app/cli/pkg/action/attestation_init.go:203">
P3: The PR-mode suppression branch is not exercised through `AttestationInit.Run`; the current helper test could pass while the request still sends the wrong pointer after a future refactor. A focused action/fake-client test covering omitted, explicit false, and explicit true inputs would lock down the three-state behavior.

(Based on your team's feedback about tests for new paths.) [FEEDBACK_USED]</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P3: The PR-mode suppression branch is not exercised through AttestationInit.Run; the current helper test could pass while the request still sends the wrong pointer after a future refactor. A focused action/fake-client test covering omitted, explicit false, and explicit true inputs would lock down the three-state behavior.

(Based on your team's feedback about tests for new paths.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At app/cli/pkg/action/attestation_init.go, line 203:

<comment>The PR-mode suppression branch is not exercised through `AttestationInit.Run`; the current helper test could pass while the request still sends the wrong pointer after a future refactor. A focused action/fake-client test covering omitted, explicit false, and explicit true inputs would lock down the three-state behavior.

(Based on your team's feedback about tests for new paths.) </comment>

<file context>
@@ -194,13 +194,16 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 	if err != nil {
 		action.Logger.Warn().Err(err).Msg("failed to detect PR context")
 	}
+	if isPR && !explicitMarkAsLatestTrue(opts.MarkAsLatest) {
+		falseVal := false
+		opts.MarkAsLatest = &falseVal
</file context>

[github-actions]

This pull request is stale because it has been open for 60 days with no activity. It will be closed in 7 days if no further activity occurs.

[github-actions]

This pull request was closed because it has been inactive for 7 days since being marked as stale. Feel free to reopen if it is still relevant.

[chainloop-platform]

AI Session Checks — ⚠️ no AI session found

Missing AI Coding Sessions

This organization requires every PR to be backed by a Chainloop Trace AI coding session, and none was found for this one.

Please make sure the AI coding session evidence has been sent by the Chainloop CLI, or add the skip-ai-session label to this PR to bypass this check.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace