Skip to content

Fix list attestations so that it can find projects by full_path

Sam Roque-Worcelrequested to merge
slsa-fix-slug-path2 into master

What does this MR do and why?

When doing verification for Create Attestations List API, I noticed that while it was working correctly there's a bug in the implementation where we can refer to projects by full_path, doing so results in an empty result. I wanted to provide before/after scripts but I can't locally because of the GDK incident.

Current behaviour

% curl --location --output - -q --url "http://gitlab.com/api/v4/projects/sroque-worcel%2ftest-slsa-worker/attestations/76c34666f719ef14bd2b124a7db51e9c05e4db2e12a84800296d559064eebe2c"
[]

% curl --location --output - -q --url "http://gitlab.com/api/v4/projects/72356192/attestations/76c34666f719ef14bd2b124a7db51e9c05e4db2e12a84800296d559064eebe2c"
[{"id":1,"created_at":"2025-10-07T20:59:27.085Z","updated_at":"2025-10-07T20:59:27.085Z","expire_at":"2027-10-07T20:59:26.967Z","project_id":72356192,"build_id":11637492236,"status":"success","predicate_kind":"provenance","predicate_type":"https://slsa.dev/provenance/v1","subject_digest":"76c34666f719ef14bd2b124a7db51e9c05e4db2e12a84800296d559064eebe2c"}]

Expected behaviour

% curl --location --output - -q --url "http://gitlab.com/api/v4/projects/sroque-worcel%2ftest-slsa-worker/attestations/76c34666f719ef14bd2b124a7db51e9c05e4db2e12a84800296d559064eebe2c"
[{"id":1,"created_at":"2025-10-07T20:59:27.085Z","updated_at":"2025-10-07T20:59:27.085Z","expire_at":"2027-10-07T20:59:26.967Z","project_id":72356192,"build_id":11637492236,"status":"success","predicate_kind":"provenance","predicate_type":"https://slsa.dev/provenance/v1","subject_digest":"76c34666f719ef14bd2b124a7db51e9c05e4db2e12a84800296d559064eebe2c"}]

% curl --location --output - -q --url "http://gitlab.com/api/v4/projects/72356192/attestations/76c34666f719ef14bd2b124a7db51e9c05e4db2e12a84800296d559064eebe2c"
[{"id":1,"created_at":"2025-10-07T20:59:27.085Z","updated_at":"2025-10-07T20:59:27.085Z","expire_at":"2027-10-07T20:59:26.967Z","project_id":72356192,"build_id":11637492236,"status":"success","predicate_kind":"provenance","predicate_type":"https://slsa.dev/provenance/v1","subject_digest":"76c34666f719ef14bd2b124a7db51e9c05e4db2e12a84800296d559064eebe2c"}]

Merge request reports