feat(container): surface provenance attestations behind feature flag [PRIM-100]

[bdemeo12]

What

Surfaces container image provenance attestations through the CLI, gated behind a feature flag.

• Bumps snyk-docker-plugin ^9.16.0 → ^9.18.0, which adds provenance attestation extraction (emits the provenanceMetadata fact).
• Gates that fact behind the surfaceProvenanceAttestations feature flag in filterDockerFacts, mirroring the existing allowNewContainerFacts pattern. When the flag is off, provenanceMetadata is filtered out before facts are sent downstream; when on, it is forwarded to Registry for upsert.

The provenance flag is independent of allowNewContainerFacts so it can be rolled out separately.

Changes

• package.json / package-lock.json — bump snyk-docker-plugin to ^9.18.0.
• src/cli/commands/constants.ts — add SURFACE_PROVENANCE_ATTESTATIONS_FEATURE_FLAG = 'surfaceProvenanceAttestations'.
• src/lib/ecosystems/common.ts — in filterDockerFacts, filter provenanceMetadata unless the flag is enabled.

Feature flag

surfaceProvenanceAttestations — defined in registry (snyk/registry#44819).

Downstream

This is the CLI half of the end-to-end provenance work. Registry relays the fact and assets-api persists it.

Notes

n/a

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	You've modified files in src/ directory, but haven't updated anything in test folder. Is there something that could be tested?
⚠️	There are multiple commits on your branch, please squash them locally before merging!
⚠️	"[feat(container): surface provenance attestations behind feature flag PRIM-100](#7047)" is too long. Keep the first line of your commit message under 72 characters.
⚠️	"[feat(container): surface provenance attestations behind feature flag PRIM-100](https://api.github.com/repos/snyk/cli/git/commits/a9a23fd0ae4f60e13f968babafad44716df71ab6)" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against df31acd

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Performance Regression 🟡 [minor] The original implementation allowed an early return of the pluginResponse if includeAllFacts was true. The new logic now forces a full map and filter pass across all scanResults and their facts whenever includeProvenanceAttestations is false, even if includeAllFacts is true. For large container images with thousands of facts, this adds unnecessary iteration overhead to the scan pipeline for a flag that will be disabled for most users initially. if (includeAllFacts && includeProvenanceAttestations) { return pluginResponse; } // At least one flag is disabled = filter out the corresponding facts return { ...pluginResponse, scanResults: pluginResponse.scanResults.map( (scanResult: ScanResult, index: number) => ({ ...scanResult, facts: scanResult.facts.filter((fact) => { // Provenance attestations are only surfaced when their flag is on, // independently of the new-facts flag. if (fact.type === PROVENANCE_METADATA_FACT_TYPE) { return includeProvenanceAttestations; } // When the new-facts flag is on, keep all remaining facts. if (includeAllFacts) { return true; } return !shouldFilterFact(fact, index === 0); }),

📚 Repository Context Analyzed This review considered 7 relevant code sections from 4 files (average relevance: 0.56) package.json (lines 1-236) package-lock.json (4 segments, lines 19475-19770) src/lib/ecosystems/common.ts (lines 1-95) src/cli/commands/constants.ts (lines 1-15)

🤖 Repository instructions applied (from AGENTS.md)