Function groupEvaluations

pkg/attestation/renderer/chainloop/v02.go:350–399

groupEvaluations groups a flat list of policy evaluations by material and aggregates counters. When includeSuppressed is true the returned entries keep their suppressed violations and finding data (CAS bundle path); when false they are stripped (in-toto predicate path). Gate counters (violationsCou

(evals []*v1.PolicyEvaluation, includeSuppressed bool)

// exclude suppressed entries regardless of the flag — suppressedCount is
// tracked independently.
func groupEvaluations(evals []*v1.PolicyEvaluation, includeSuppressed bool) (*evaluationsResult, error) {
	res := &evaluationsResult{
		evaluations: make(map[string][]*PolicyEvaluation),
	}

	for _, p := range evals {
		keyName := p.MaterialName
		if keyName == "" {
			keyName = AttPolicyEvaluation
		}

		var active, suppressed int
		for _, vi := range p.Violations {
			if vi.GetSuppress() {
				suppressed++
			} else {
				active++
			}
		}

		ev, err := renderEvaluation(p, includeSuppressed)
		if err != nil {
			return nil, err
		}

		if ev.Gate {
			res.hasGates = true
		}

		res.suppressedCount += suppressed

		switch {
		case active > 0:
			res.hasViolations = true
			res.violationsCount += active
			if ev.Gate {
				res.hasGatedViolations = true
			}
		case ev.Skipped:
			res.skippedCount++
		default:
			res.passedCount++
		}

		res.evaluations[keyName] = append(res.evaluations[keyName], ev)
	}

	res.evaluationsCount = len(evals)
	return res, nil
}

func renderEvaluation(ev *v1.PolicyEvaluation, includeSuppressed bool) (*PolicyEvaluation, error) {
	violations := make([]*PolicyViolation, 0, len(ev.Violations))