Roll per-platform child referrers up to the index in graph queries - #221
Merged
Conversation
When a query subject is a multi-arch index, referrers attached to its per-platform child manifests (e.g. per-platform attestations) are now rolled up onto the index via HAS_PLATFORM: their REFERS_TO edges point at the index and carry a platform label, so every attestation attaches to the pipeline image instead of dangling off an isolated child manifest. - queries.referrers: rollup=True (default); _platform_children/_platform_label helpers - edge/CLI/mermaid/cytoscape renderers surface the platform label - example: attestation on the amd64 child; rollup + no-rollup tests - docs: HAS_PLATFORM + roll-up behavior in the graph model Fixes #217
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the supply-chain graph query/rendering layer so referrers (e.g., attestations) that are attached to per-platform child manifests can be “rolled up” and displayed as referring to the multi-arch index, closing a visualization gap for multi-arch images.
Changes:
- Add
rollup(defaultTrue) toqueries.referrers()to attribute per-platform child referrers to the parent index and tag edges with aplatformlabel. - Surface platform labels in Cytoscape/Mermaid exports and CLI text output.
- Add a new example referrer record and extend tests to validate rollup vs. no-rollup behavior; document the updated graph model behavior.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| supply-chain-graph/examples/referrer-observed-platform.yaml | Adds an example ReferrerObserved record for a per-platform child attestation. |
| docs/architecture/observability/supply-chain-graph.md | Documents HAS_PLATFORM and the referrer roll-up behavior in the graph model docs (plus formatting changes). |
| apps/python-app/libs/cssc_graph/tests/test_queries.py | Adds tests covering rollup behavior and ensuring child nodes are not introduced by rollup. |
| apps/python-app/libs/cssc_graph/cssc_graph/queries.py | Implements rollup logic in referrers(), refactors platform child retrieval, and adds edge labeling helper. |
| apps/python-app/libs/cssc_graph/cssc_graph/cli.py | Updates CLI text output to include {platform} for edges/referrers when present. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…ervice (rollup query param); fix HTTP API doc fence nesting + document referrers endpoint
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Closes the visualization gap identified in #210: per-platform attestations attach to a multi-arch index's child manifests, but promote/build lineage points at the index, so those referrers rendered as isolated satellites (8 of 9 golden/python referrers).
Building on the
HAS_PLATFORMmodel added in #216,queries.referrers()now rolls a child's referrers up onto its index: when the subject is a multi-arch index, referrers on its per-platform children are returned asREFERS_TOedges pointing at the index, each tagged with aplatformlabel (os/architecture[/variant]). Every attestation now attaches to the pipeline image.Changes
rollup=True(default) parameter; gathers each index seed'sHAS_PLATFORMchildren and attributes their referrer edges to the index with aplatformlabel.rollup=Falsepreserves the old strict behaviour. Added_platform_children/_platform_labelhelpers (and refactoredplatforms()to reuse them)._edge_labelsurfaces the platform on cytoscape/mermaid edges and the CLI subgraph/showoutput.application/vnd.in-toto+jsonattestation on the amd64 child, plus rollup + no-rollup tests.HAS_PLATFORMand the roll-up behaviour documented in the graph model.53 cssc_graph tests pass; graph-service (18) and dashboard-web (25) suites unaffected.
Fixes #217