chore(sdks): Bootstrap Go and Javascript policy sdks

[javirln]

This PR introduces the initial bootstrap of the SDKs for Golang and Javascript to write custom policies with them. For the moment, chainloop policy develop init does not creates the skeleton of the policies but it will in a future version of it.

The SDKs are meant to ease the development of policies in these two languages.

Implementation

Go SDK (policies/go/)

• TinyGo-based SDK compiling to WASM
• Simple API: Run(), GetMaterialJSON(), Success(), Fail(), Skip()
• Built-in HTTP support with hostname restrictions
• Artifact discovery via Discover() builtin
• Full logging support (LogInfo, LogDebug, LogWarn, LogError)
• Policy arguments with GetArgs() and GetArgStringDefault()

JavaScript SDK (policies/js/)

• Extism JS-based SDK compiling to WASM
• Modular architecture: separate files for material, args, http, logging, result, discover
• CommonJS module exports via index.js
• Same feature parity as Go SDK
• Compatible with esbuild bundling

Shared Features

• Material extraction (JSON, string, bytes)
• Result building with violations
• HTTP requests with allowed hostname restrictions
• Artifact graph discovery
• Skip/Success/Fail result states

Examples

5 complete examples per SDK: simple, sbom, attestation, http, discover

Builtin Function Namespace Support

WASM runtimes use different namespace conventions by language:

• Go/TinyGo: Expects host functions in env namespace (WASI standard)
• JavaScript/Extism: Expects host functions in extism:host/user namespace

The discover builtin is registered in both namespaces with identical implementation, enabling cross-language compatibility without code duplication.

Discover

As introduced in the rego engine, now the discover function is also available in the WASM engine. As expected it outputs the same result:

Javascript

❯ ./chainloop policy devel eval --material ghcr.io/chainloop-dev/chainloop/control-plane:v1.57.0-amd64 --policy policies/js/examples/discover/policy.yaml
INF Discovering artifacts related to: sha256:2680364af8645b2ded3e52df0f3aa4a7fbcceee57f2868c6a40132da47e2cb3f policy=policy-builtins
INF Found 1 references for artifact sha256:2680364af8645b2ded3e52df0f3aa4a7fbcceee57f2868c6a40132da47e2cb3f policy=policy-builtins
INF Checking attestation: sha256:5d2ae3589cd46277fb83b1e9a3eb4c58dfb0c1e042729520119ed0533ef7cd6d policy=policy-builtins
ERR attestation with digest sha256:5d2ae3589cd46277fb83b1e9a3eb4c58dfb0c1e042729520119ed0533ef7cd6d contains policy violations [name: release, project: chainloop, org: read-only-demo] policy=policy-builtins
ERR Validation failed: found attestations with policy violations policy=policy-builtins
{
   "result": {
      "violations": [
         "attestation with digest sha256:5d2ae3589cd46277fb83b1e9a3eb4c58dfb0c1e042729520119ed0533ef7cd6d contains policy violations [name: release, project: chainloop, org: read-only-demo]"
      ],
      "skip_reasons": [],
      "skipped": false
   }
}

Golang

❯ ./chainloop policy devel eval --material ghcr.io/chainloop-dev/chainloop/control-plane:v1.57.0-amd64 --policy policies/go/examples/discover/policy.yaml
INF Discovering artifacts related to: sha256:2680364af8645b2ded3e52df0f3aa4a7fbcceee57f2868c6a40132da47e2cb3f policy=policy-builtins
INF Found 1 references for artifact sha256:2680364af8645b2ded3e52df0f3aa4a7fbcceee57f2868c6a40132da47e2cb3f policy=policy-builtins
INF Checking attestation: sha256:5d2ae3589cd46277fb83b1e9a3eb4c58dfb0c1e042729520119ed0533ef7cd6d policy=policy-builtins
ERR attestation with digest sha256:5d2ae3589cd46277fb83b1e9a3eb4c58dfb0c1e042729520119ed0533ef7cd6d contains policy violations [name: release, project: chainloop, org: read-only-demo] policy=policy-builtins
ERR Validation failed: found attestations with policy violations policy=policy-builtins
{
   "result": {
      "violations": [
         "attestation with digest sha256:5d2ae3589cd46277fb83b1e9a3eb4c58dfb0c1e042729520119ed0533ef7cd6d contains policy violations [name: release, project: chainloop, org: read-only-demo]"
      ],
      "skip_reasons": [],
      "skipped": false
   }
}

[jiparis]

thanks @javirln! This is a great addition

[jiparis]

I wonder if the Rego engine can also leverage this option. We can review it in a future change.

[javirln]

Oki!

[javirln]

Thanks @jiparis :)