Fix: Have the policy-tester library check policy result.

[mattmoor]

🐛 The policy tester library blindly checked the errors, but with multiple authorities we might have errors, but still successfully evaluated the policy.

Here is the comment from the ~equivalent call to ValidatePolicy( from validator.go for comparison:

			switch {
			// Return AuthorityMatches before errors, since even if there
			// are errors, if there are 0 or more authorities that match,
			// it will pass the Policy. Of course, a CIP level policy can
			// override this behaviour, but that has been checked above and
			// if it failed, it will nil out the policyResult.
			case result.policyResult != nil:
				policyResults[result.name] = result.policyResult
			case len(result.errors) > 0:
				ret[result.name] = append(ret[result.name], result.errors...)
			default:
				ret[result.name] = append(ret[result.name], fmt.Errorf("failed to process policy: %s", result.name))
			}

... with this I was able to successfully run the policy tester using a policy that had a separate authority for SLSA v0.2 and v1 predicate types without it failing.

/kind bug

Release Note

The policy tester library now properly treats authorities as an OR instead of erroring if any of them surface errors.

Documentation

[codecov]

Codecov Report

Merging #809 (b4622d1) into main (1b402ff) will increase coverage by 0.03%.
The diff coverage is 87.50%.

@@            Coverage Diff             @@
##             main     #809      +/-   ##
==========================================
+ Coverage   54.95%   54.98%   +0.03%     
==========================================
  Files          45       45              
  Lines        4786     4790       +4     
==========================================
+ Hits         2630     2634       +4     
  Misses       1946     1946              
  Partials      210      210              

Impacted Files	Coverage Δ
pkg/policy/verifier.go	66.32% <87.50%> (+1.43%)	⬆️

[mattmoor]

cc @vaikas @hectorj2f

[hectorj2f]

Thanks @mattmoor