Function buildRuntimeInputs

app/cli/pkg/action/attestation_add.go:199–227

buildRuntimeInputs reads each policy input file and returns the extracted values grouped for the policy engine: unscoped entries under Global and policy-scoped entries under Scoped[policy]. Values are newline-joined and accumulated via policies.MergeRuntimeInputs so repeated inputs merge using the s

(policyInputFiles []*PolicyInputFromFile)

// newlines and commas). As with contract-declared arguments, individual values
// must not embed those delimiters; path globs, the intended use, never do.
func buildRuntimeInputs(policyInputFiles []*PolicyInputFromFile) (*policies.RuntimeInputs, error) {
	if len(policyInputFiles) == 0 {
		return nil, nil
	}

	ri := &policies.RuntimeInputs{
		Global: map[string]string{},
		Scoped: map[string]map[string]string{},
	}
	for _, pif := range policyInputFiles {
		values, err := ExtractColumnValues(pif.File, pif.Column)
		if err != nil {
			return nil, fmt.Errorf("extracting %q from %q: %w", pif.Column, pif.File, err)
		}

		// Unscoped entries go to Global; policy-scoped entries to their own
		// Scoped[policy] map. Because global and scoped values live in separate
		// maps, they never collide here even when they share an input name;
		// forPolicy is what later merges a policy's scoped values over Global.
		add := map[string]string{pif.Input: strings.Join(values, "\n")}
		if pif.Policy == "" {
			ri.Global = policies.MergeRuntimeInputs(ri.Global, add)
		} else {
			ri.Scoped[pif.Policy] = policies.MergeRuntimeInputs(ri.Scoped[pif.Policy], add)
		}
	}

	return ri, nil
}

// addPolicyInputEvidence adds each policy input file as an EVIDENCE material,
// cross-linked with the evaluated material in both directions via the