Allow hyphens in annotation names

app/controlplane/api/workflowcontract/v1/crafting_schema.proto

@@ -241,7 +241,7 @@ message CraftingSchemaV2Spec {
 }
 
 message Annotation {
-  string name = 1 [(buf.validate.field).string.pattern = "^[\\w]+$"]; // Single word optionally separated with _
+  string name = 1 [(buf.validate.field).string.pattern = "^[\\w-]+$"]; // Single word optionally separated with _ or -
   // This value can be set in the contract or provided during the attestation
   string value = 2;
 }

app/controlplane/api/workflowcontract/v1/crafting_schema_test.go

@@ -13,18 +13,19 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// limitations under the License.
-
 package v1_test
 
 import (
 	"errors"
 	"testing"
 
+	validate "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
 	"buf.build/go/protovalidate"
 	v1 "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/descriptorpb"
 )
 
 func TestValidateAnnotations(t *testing.T) {
@@ -50,17 +51,28 @@ func TestValidateAnnotations(t *testing.T) {
 			value: "hello_world",
 		},
 		{
-			desc:    "invalid key hyphen",
-			name:    "hello-world",
-			value:   "hello-world",
-			wantErr: true,
+			desc:  "valid key hyphen",
+			name:  "hello-world",
+			value: "hello-world",
 		},
 		{
 			desc:    "invalid key space",
 			name:    " hello",
 			value:   "hello-world",
 			wantErr: true,
 		},
+		{
+			desc:    "invalid key punctuation",
+			name:    "hello.world",
+			value:   "hello",
+			wantErr: true,
+		},
+		{
+			desc:    "invalid key slash",
+			name:    "hello/world",
+			value:   "hello",
+			wantErr: true,
+		},
 		{
 			desc:  "valid key camel case",
 			name:  "helloWorld",
@@ -94,6 +106,19 @@ func TestValidateAnnotations(t *testing.T) {
 	}
 }
 
+func TestAnnotationNameConstraintAllowsHyphen(t *testing.T) {
+	field := (&v1.Annotation{}).ProtoReflect().Descriptor().Fields().ByName("name")
+	require.NotNil(t, field)
+
+	opts, ok := field.Options().(*descriptorpb.FieldOptions)
+	require.True(t, ok)
+
+	constraints, ok := proto.GetExtension(opts, validate.E_Field).(*validate.FieldRules)
+	require.True(t, ok)
+	require.NotNil(t, constraints.GetString())
+	assert.Equal(t, `^[\w-]+$`, constraints.GetString().GetPattern())
+}
+
 func TestPolicyAttachment(t *testing.T) {
 	testCases := []struct {
 		desc           string

app/controlplane/plugins/core/dependency-track/v1/extension_test.go

@@ -146,11 +146,17 @@ func TestResolveProjectName(t *testing.T) {
 			projectName: "{{.Attestation.Annotations.Version}}",
 			want:        "1.2.3",
 		},
+		{
+			name:        "hyphenated annotation interpolates via index",
+			projectName: `{{ index .Material.Annotations "my-annotation" }}`,
+			want:        "hyphen-ok",
+		},
 	}
 
 	sbomAnnotation := map[string]string{
-		"hello": "hola",
-		"world": "mundo",
+		"hello":         "hola",
+		"world":         "mundo",
+		"my-annotation": "hyphen-ok",
 	}
 
 	attAnnotation := map[string]string{
@@ -348,8 +354,9 @@ func TestVerifyAllFilters(t *testing.T) {
 	}
 
 	materialAnnotations := map[string]string{
-		"environment": "staging",
-		"critical":    "true",
+		"environment":   "staging",
+		"critical":      "true",
+		"release-stage": "ga",
 	}
 
 	testCases := []struct {
@@ -398,6 +405,10 @@ func TestVerifyAllFilters(t *testing.T) {
 			filter: "environment",
 			errMsg: "invalid filter segment",
 		},
+		{
+			name:   "hyphenated annotation name matches",
+			filter: "release-stage=ga",
+		},
 	}
 
 	for _, tc := range testCases {