chore(audit): Instrument Workflows with event auditor

app/controlplane/configs/config.devel.yaml

@@ -17,7 +17,7 @@ server:
     #   private_key: "../../devel/devkeys/selfsigned/controlplane.key"
 
 # nats_server:
-#   uri: nats://0.0.0.0:4222
+#  uri: nats://0.0.0.0:4222
 
 certificate_authorities:
   - issuer: true

app/controlplane/pkg/auditor/events/testdata/users/user_logs_in.json

@@ -13,4 +13,4 @@
     "LoggedIn": "2024-01-01T00:00:00Z"
   },
   "Digest": "sha256:9a2d11d9423700c50b7a9b1d6e40b3327b3fa3afe4e33f72d1c8b20d733717bd"
-}
+}

app/controlplane/pkg/auditor/events/testdata/workflowcontracts/workflow_attached_to_contract.json

@@ -2,7 +2,7 @@
   "ActionType": "WorkflowContractContractAttached",
   "TargetType": "WorkflowContract",
   "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
-  "ActorType": "API_TOKEN",
+  "ActorType": "USER",
   "ActorID": "1089bb36-e27b-428b-8009-d015c8737c54",
   "ActorEmail": "john@cyberdyne.io",
   "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",

app/controlplane/pkg/auditor/events/testdata/workflowcontracts/workflow_contract_created.json

@@ -2,7 +2,7 @@
   "ActionType": "WorkflowContractCreated",
   "TargetType": "WorkflowContract",
   "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
-  "ActorType": "API_TOKEN",
+  "ActorType": "USER",
   "ActorID": "1089bb36-e27b-428b-8009-d015c8737c54",
   "ActorEmail": "john@cyberdyne.io",
   "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",

app/controlplane/pkg/auditor/events/testdata/workflowcontracts/workflow_contract_deleted.json

@@ -2,7 +2,7 @@
   "ActionType": "WorkflowContractDeleted",
   "TargetType": "WorkflowContract",
   "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
-  "ActorType": "API_TOKEN",
+  "ActorType": "USER",
   "ActorID": "1089bb36-e27b-428b-8009-d015c8737c54",
   "ActorEmail": "john@cyberdyne.io",
   "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",

app/controlplane/pkg/auditor/events/testdata/workflowcontracts/workflow_contract_updated.json

@@ -2,7 +2,7 @@
   "ActionType": "WorkflowContractUpdated",
   "TargetType": "WorkflowContract",
   "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
-  "ActorType": "API_TOKEN",
+  "ActorType": "USER",
   "ActorID": "1089bb36-e27b-428b-8009-d015c8737c54",
   "ActorEmail": "john@cyberdyne.io",
   "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",

app/controlplane/pkg/auditor/events/testdata/workflowcontracts/workflow_detached_from_contract.json

@@ -2,7 +2,7 @@
   "ActionType": "WorkflowContractContractDetached",
   "TargetType": "WorkflowContract",
   "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
-  "ActorType": "API_TOKEN",
+  "ActorType": "USER",
   "ActorID": "1089bb36-e27b-428b-8009-d015c8737c54",
   "ActorEmail": "john@cyberdyne.io",
   "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",

app/controlplane/pkg/auditor/events/testdata/workflows/workflow_created.json

@@ -0,0 +1,20 @@
+{
+  "ActionType": "WorkflowCreated",
+  "TargetType": "Workflow",
+  "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorType": "USER",
+  "ActorID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorEmail": "john@cyberdyne.io",
+  "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "Description": "john@cyberdyne.io has created the workflow test-workflow on project test-project with the contract test-contract",
+  "Info": {
+    "workflow_id": "1089bb36-e27b-428b-8009-d015c8737c54",
+    "workflow_name": "test-workflow",
+    "project_name": "test-project",
+    "workflow_contract_id": "1089bb36-e27b-428b-8009-d015c8737c54",
+    "workflow_contract_name": "test-contract",
+    "description": "test description",
+    "team": "test-team"
+  },
+  "Digest": "sha256:b3c8f05e7def2e9de7c4f474175b852b1c29a3e7f9dd44f994201fbfd17de490"
+}

app/controlplane/pkg/auditor/events/testdata/workflows/workflow_created_by_api_token.json

@@ -0,0 +1,20 @@
+{
+  "ActionType": "WorkflowCreated",
+  "TargetType": "Workflow",
+  "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorType": "API_TOKEN",
+  "ActorID": "2089bb36-e27b-428b-8009-d015c8737c55",
+  "ActorEmail": "",
+  "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "Description": "API Token 2089bb36-e27b-428b-8009-d015c8737c55 has created the workflow test-workflow on project test-project with the contract test-contract",
+  "Info": {
+    "workflow_id": "1089bb36-e27b-428b-8009-d015c8737c54",
+    "workflow_name": "test-workflow",
+    "project_name": "test-project",
+    "workflow_contract_id": "1089bb36-e27b-428b-8009-d015c8737c54",
+    "workflow_contract_name": "test-contract",
+    "description": "test description",
+    "team": "test-team"
+  },
+  "Digest": "sha256:c2a947583e61b2941d4a1433302129e2f8dad9f57eb8a105c324842ee81aac00"
+}

app/controlplane/pkg/auditor/events/testdata/workflows/workflow_deleted.json

@@ -0,0 +1,16 @@
+{
+  "ActionType": "WorkflowDeleted",
+  "TargetType": "Workflow",
+  "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorType": "USER",
+  "ActorID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorEmail": "john@cyberdyne.io",
+  "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "Description": "john@cyberdyne.io has deleted the workflow test-contract",
+  "Info": {
+    "workflow_id": "1089bb36-e27b-428b-8009-d015c8737c54",
+    "workflow_name": "test-contract",
+    "project_name": "test-project"
+  },
+  "Digest": "sha256:f81f68c312421ad0cc06c86e73c732e889e86028f53f06c274b358bed19d7e8e"
+}

app/controlplane/pkg/auditor/events/testdata/workflows/workflow_deleted_by_api_token.json

@@ -0,0 +1,16 @@
+{
+  "ActionType": "WorkflowDeleted",
+  "TargetType": "Workflow",
+  "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorType": "API_TOKEN",
+  "ActorID": "2089bb36-e27b-428b-8009-d015c8737c55",
+  "ActorEmail": "",
+  "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "Description": "API Token 2089bb36-e27b-428b-8009-d015c8737c55 has deleted the workflow test-contract",
+  "Info": {
+    "workflow_id": "1089bb36-e27b-428b-8009-d015c8737c54",
+    "workflow_name": "test-contract",
+    "project_name": "test-project"
+  },
+  "Digest": "sha256:e461b550b100a5891dbcf62db574afe9a7b4562cc062725c2c4da90b56674ac9"
+}

app/controlplane/pkg/auditor/events/testdata/workflows/workflow_updated.json

@@ -0,0 +1,19 @@
+{
+  "ActionType": "WorkflowUpdated",
+  "TargetType": "Workflow",
+  "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorType": "USER",
+  "ActorID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorEmail": "john@cyberdyne.io",
+  "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "Description": "john@cyberdyne.io has updated the workflow test-contract on project test-project",
+  "Info": {
+    "workflow_id": "1089bb36-e27b-428b-8009-d015c8737c54",
+    "workflow_name": "test-contract",
+    "project_name": "test-project",
+    "new_description": "test description",
+    "new_team": "test-team",
+    "new_public": true
+  },
+  "Digest": "sha256:96de55711fafc04c5f2e7a0b6d6a40df835bde6c9dbe148b00f565b3915c2229"
+}

app/controlplane/pkg/auditor/events/testdata/workflows/workflow_updated_by_api_token.json

@@ -0,0 +1,19 @@
+{
+  "ActionType": "WorkflowUpdated",
+  "TargetType": "Workflow",
+  "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorType": "API_TOKEN",
+  "ActorID": "2089bb36-e27b-428b-8009-d015c8737c55",
+  "ActorEmail": "",
+  "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "Description": "API Token 2089bb36-e27b-428b-8009-d015c8737c55 has updated the workflow test-contract on project test-project",
+  "Info": {
+    "workflow_id": "1089bb36-e27b-428b-8009-d015c8737c54",
+    "workflow_name": "test-contract",
+    "project_name": "test-project",
+    "new_description": "test description",
+    "new_team": "test-team",
+    "new_public": true
+  },
+  "Digest": "sha256:fc33dee1b1a043d847a6c4c0d945f75d18508675569f43915a7149e9e756ad65"
+}

app/controlplane/pkg/auditor/events/testdata/workflows/workflow_updated_with_workflow_contract.json

@@ -0,0 +1,21 @@
+{
+  "ActionType": "WorkflowUpdated",
+  "TargetType": "Workflow",
+  "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorType": "USER",
+  "ActorID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorEmail": "john@cyberdyne.io",
+  "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "Description": "john@cyberdyne.io has updated the workflow test-contract on project test-project",
+  "Info": {
+    "workflow_id": "1089bb36-e27b-428b-8009-d015c8737c54",
+    "workflow_name": "test-contract",
+    "project_name": "test-project",
+    "new_description": "test description",
+    "new_team": "test-team",
+    "new_public": true,
+    "new_workflow_contract_id": "1089bb36-e27b-428b-8009-d015c8737c54",
+    "new_workflow_contract_name": "test-contract"
+  },
+  "Digest": "sha256:9e28ae18fa9d44faa4a6d072f928bd9b70bda9aded9abdcedc776819f4e638e7"
+}

app/controlplane/pkg/auditor/events/testdata/workflows/workflow_updated_with_workflow_contract_by_api_token.json

@@ -0,0 +1,21 @@
+{
+  "ActionType": "WorkflowUpdated",
+  "TargetType": "Workflow",
+  "TargetID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorType": "API_TOKEN",
+  "ActorID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "ActorEmail": "",
+  "OrgID": "1089bb36-e27b-428b-8009-d015c8737c54",
+  "Description": "API Token 1089bb36-e27b-428b-8009-d015c8737c54 has updated the workflow test-contract on project test-project",
+  "Info": {
+    "workflow_id": "1089bb36-e27b-428b-8009-d015c8737c54",
+    "workflow_name": "test-contract",
+    "project_name": "test-project",
+    "new_description": "test description",
+    "new_team": "test-team",
+    "new_public": true,
+    "new_workflow_contract_id": "1089bb36-e27b-428b-8009-d015c8737c54",
+    "new_workflow_contract_name": "test-contract"
+  },
+  "Digest": "sha256:9e28ae18fa9d44faa4a6d072f928bd9b70bda9aded9abdcedc776819f4e638e7"
+}

app/controlplane/pkg/auditor/events/workflow.go

@@ -0,0 +1,144 @@
+//
+// Copyright 2025 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package events
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/auditor"
+
+	"github.com/google/uuid"
+)
+
+var (
+	_ auditor.LogEntry = (*WorkflowCreated)(nil)
+)
+
+const (
+	WorkflowType              auditor.TargetType = "Workflow"
+	WorkflowCreatedActionType string             = "WorkflowCreated"
+	WorkflowUpdatedActionType string             = "WorkflowUpdated"
+	WorkflowDeletedActionType string             = "WorkflowDeleted"
+)
+
+// WorkflowBase is the base struct for workflow events
+type WorkflowBase struct {
+	WorkflowID   *uuid.UUID `json:"workflow_id,omitempty"`
+	WorkflowName string     `json:"workflow_name,omitempty"`
+	ProjectName  string     `json:"project_name,omitempty"`
+}
+
+func (w *WorkflowBase) RequiresActor() bool {
+	return true
+}
+
+func (w *WorkflowBase) TargetType() auditor.TargetType {
+	return WorkflowType
+}
+
+func (w *WorkflowBase) TargetID() *uuid.UUID {
+	return w.WorkflowID
+}
+
+func (w *WorkflowBase) ActionInfo() (json.RawMessage, error) {
+	if w.WorkflowID == nil || w.WorkflowName == "" || w.ProjectName == "" {
+		return nil, errors.New("workflow id, name and project name are required")
+	}
+
+	return json.Marshal(&w)
+}
+
+type WorkflowCreated struct {
+	*WorkflowBase
+	WorkflowContractID   *uuid.UUID `json:"workflow_contract_id,omitempty"`
+	WorkflowContractName string     `json:"workflow_contract_name,omitempty"`
+	WorkflowDescription  *string    `json:"description,omitempty"`
+	Team                 *string    `json:"team,omitempty"`
+	Public               bool       `json:"public,omitempty"`
+}
+
+func (w *WorkflowCreated) TargetID() *uuid.UUID {
+	return w.WorkflowID
+}
+
+func (w *WorkflowCreated) Description() string {
+	workflowName := w.WorkflowName
+	projectName := w.ProjectName
+	workflowContractName := w.WorkflowContractName
+	return fmt.Sprintf("{{ if .ActorEmail }}{{ .ActorEmail }}{{ else }}API Token {{ .ActorID }}{{ end }} has created the workflow %s on project %s with the contract %s", workflowName, projectName, workflowContractName)
+}
+
+func (w *WorkflowCreated) ActionType() string {
+	return WorkflowCreatedActionType
+}
+
+func (w *WorkflowCreated) ActionInfo() (json.RawMessage, error) {
+	if w.WorkflowID == nil || w.WorkflowName == "" || w.ProjectName == "" || w.WorkflowContractID == nil || w.WorkflowContractName == "" {
+		return nil, errors.New("workflow id, name, project name, contract id and contract name required")
+	}
+
+	return json.Marshal(&w)
+}
+
+type WorkflowUpdated struct {
+	*WorkflowBase
+	NewDescription          *string    `json:"new_description,omitempty"`
+	NewTeam                 *string    `json:"new_team,omitempty"`
+	NewPublic               *bool      `json:"new_public,omitempty"`
+	NewWorkflowContractID   *uuid.UUID `json:"new_workflow_contract_id,omitempty"`
+	NewWorkflowContractName *string    `json:"new_workflow_contract_name,omitempty"`
+}
+
+func (w *WorkflowUpdated) ActionType() string {
+	return WorkflowUpdatedActionType
+}
+
+func (w *WorkflowUpdated) ActionInfo() (json.RawMessage, error) {
+	if w.WorkflowID == nil || w.WorkflowName == "" || w.ProjectName == "" {
+		return nil, errors.New("workflow id, name and project name are required")
+	}
+
+	return json.Marshal(&w)
+}
+
+func (w *WorkflowUpdated) Description() string {
+	workflowName := w.WorkflowName
+	projectName := w.ProjectName
+	return fmt.Sprintf("{{ if .ActorEmail }}{{ .ActorEmail }}{{ else }}API Token {{ .ActorID }}{{ end }} has updated the workflow %s on project %s", workflowName, projectName)
+}
+
+type WorkflowDeleted struct {
+	*WorkflowBase
+}
+
+func (w *WorkflowDeleted) ActionType() string {
+	return WorkflowDeletedActionType
+}
+
+func (w *WorkflowDeleted) ActionInfo() (json.RawMessage, error) {
+	if w.WorkflowID == nil || w.WorkflowName == "" || w.ProjectName == "" {
+		return nil, errors.New("workflow id, name and project name are required")
+	}
+
+	return json.Marshal(&w)
+}
+
+func (w *WorkflowDeleted) Description() string {
+	wfName := w.WorkflowName
+	return fmt.Sprintf("{{ if .ActorEmail }}{{ .ActorEmail }}{{ else }}API Token {{ .ActorID }}{{ end }} has deleted the workflow %s", wfName)
+}