feat: add gate support for policy groups

app/controlplane/api/workflowcontract/v1/crafting_schema.proto

@@ -389,6 +389,11 @@ message PolicyGroupAttachment {
   map<string, string> with = 2;
   // policy names to skip (matched against metadata.name)
   repeated string skip = 3;
+  // Controls whether policy violations act as a gate for this group.
+  // - true: policy violations are blocking for this policy group
+  // - false: policy violations are non-blocking for this policy group
+  // - unset: inherit organization-level default behavior
+  optional bool gate = 4;
 }
 
 // Represents a group or policies

pkg/policies/policy_groups.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -28,6 +28,7 @@ import (
 	intoto "github.com/in-toto/attestation/go/v1"
 	"github.com/rs/zerolog"
 	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
 )
 
 type PolicyGroupVerifier struct {
@@ -91,7 +92,7 @@ func (pgv *PolicyGroupVerifier) VerifyMaterial(ctx context.Context, material *ap
 				return nil, NewPolicyError(err)
 			}
 
-			ev, err := pgv.evaluatePolicyAttachment(ctx, policyAtt, subject,
+			ev, err := pgv.evaluatePolicyAttachment(ctx, applyGroupGate(policyAtt, groupAtt), subject,
 				&evalOpts{kind: material.MaterialType, name: material.GetId(), bindings: groupArgs},
 			)
 			if err != nil {
@@ -154,7 +155,7 @@ func (pgv *PolicyGroupVerifier) VerifyStatement(ctx context.Context, statement *
 				return nil, NewPolicyError(err)
 			}
 
-			ev, err := pgv.evaluatePolicyAttachment(ctx, attachment, material,
+			ev, err := pgv.evaluatePolicyAttachment(ctx, applyGroupGate(attachment, groupAtt), material,
 				&evalOpts{kind: v1.CraftingSchema_Material_ATTESTATION, bindings: groupArgs},
 			)
 			if err != nil {
@@ -181,6 +182,18 @@ func (pgv *PolicyGroupVerifier) VerifyStatement(ctx context.Context, statement *
 	return result, nil
 }
 
+func applyGroupGate(policyAtt *v1.PolicyAttachment, groupAtt *v1.PolicyGroupAttachment) *v1.PolicyAttachment {
+	if policyAtt == nil || groupAtt == nil || groupAtt.Gate == nil {
+		return policyAtt
+	}
+
+	cloned := proto.Clone(policyAtt).(*v1.PolicyAttachment)
+	groupGate := groupAtt.GetGate()
+	cloned.Gate = &groupGate
+
+	return cloned
+}
+
 type LoadPolicyGroupOptions struct {
 	Client v13.AttestationServiceClient
 	Logger *zerolog.Logger

pkg/policies/policy_groups_test.go

@@ -40,6 +40,10 @@ func TestPolicyGroups(t *testing.T) {
 	suite.Run(t, new(groupsTestSuite))
 }
 
+func boolPtr(b bool) *bool {
+	return &b
+}
+
 func (s *groupsTestSuite) TestLoadGroupSpec() {
 	var cases = []struct {
 		name             string
@@ -647,3 +651,107 @@ func (s *groupsTestSuite) TestAttestationPhaseFilteringInGroups() {
 		})
 	}
 }
+
+func (s *groupsTestSuite) TestApplyGroupGate() {
+	policyGate := false
+	groupGate := true
+
+	cases := []struct {
+		name         string
+		policyAtt    *v1.PolicyAttachment
+		groupAtt     *v1.PolicyGroupAttachment
+		expectedNil  bool
+		expectedGate *bool
+	}{
+		{
+			name:        "nil policy attachment is returned as-is",
+			policyAtt:   nil,
+			groupAtt:    &v1.PolicyGroupAttachment{Gate: &groupGate},
+			expectedNil: true,
+		},
+		{
+			name:         "unset group gate leaves policy unchanged",
+			policyAtt:    &v1.PolicyAttachment{},
+			groupAtt:     &v1.PolicyGroupAttachment{},
+			expectedGate: nil,
+		},
+		{
+			name:         "group gate sets policy gate when policy gate unset",
+			policyAtt:    &v1.PolicyAttachment{},
+			groupAtt:     &v1.PolicyGroupAttachment{Gate: &groupGate},
+			expectedGate: boolPtr(true),
+		},
+		{
+			name: "group gate overrides policy gate",
+			policyAtt: &v1.PolicyAttachment{
+				Gate: &policyGate,
+			},
+			groupAtt:     &v1.PolicyGroupAttachment{Gate: &groupGate},
+			expectedGate: boolPtr(true),
+		},
+	}
+
+	for _, tc := range cases {
+		s.Run(tc.name, func() {
+			got := applyGroupGate(tc.policyAtt, tc.groupAtt)
+
+			if tc.expectedNil {
+				s.Nil(got)
+				return
+			}
+
+			if tc.expectedGate == nil {
+				s.Nil(got.Gate)
+				return
+			}
+
+			s.Require().NotNil(got.Gate)
+			s.Equal(*tc.expectedGate, got.GetGate())
+		})
+	}
+}
+
+func (s *groupsTestSuite) TestVerifyMaterialInheritsGroupGate() {
+	schema := &v1.CraftingSchema{
+		PolicyGroups: []*v1.PolicyGroupAttachment{
+			{
+				Ref:  "file://testdata/policy_group_multikind.yaml",
+				Gate: boolPtr(true),
+			},
+		},
+	}
+
+	material := &api.Attestation_Material{
+		M: &api.Attestation_Material_Artifact_{Artifact: &api.Attestation_Material_Artifact{
+			Content: []byte(`{"specVersion": "1.4"}`),
+		}},
+		MaterialType: v1.CraftingSchema_Material_OPENVEX,
+		InlineCas:    true,
+	}
+
+	verifier := NewPolicyGroupVerifier(schema.GetPolicyGroups(), nil, nil, &s.logger, WithDefaultGate(false))
+	evs, err := verifier.VerifyMaterial(context.Background(), material, "")
+
+	s.Require().NoError(err)
+	s.Len(evs, 1)
+	s.True(evs[0].GetGate())
+}
+
+func (s *groupsTestSuite) TestVerifyStatementInheritsGroupGate() {
+	schema := &v1.CraftingSchema{
+		PolicyGroups: []*v1.PolicyGroupAttachment{
+			{
+				Ref:  "file://testdata/policy_group.yaml",
+				Gate: boolPtr(true),
+			},
+		},
+	}
+
+	verifier := NewPolicyGroupVerifier(schema.GetPolicyGroups(), nil, nil, &s.logger, WithDefaultGate(false))
+	statement := loadStatement("testdata/statement.json", &s.Suite)
+
+	evs, err := verifier.VerifyStatement(context.Background(), statement)
+	s.Require().NoError(err)
+	s.Len(evs, 1)
+	s.True(evs[0].GetGate())
+}