fix(runners): record unavailable for a given verification without a status

A given verification with no status, or with the unspecified status,
carries no result. The runner now records the unavailable status for it,
as it does for a value without a verification. Before, the attestation
recorded the unspecified status.

Assisted-by: Claude Code
Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Chainloop-Trace-Sessions: 4503bdcc-d428-4e05-ade6-966360bf5543

Author: javirln

pkg/attestation/crafter/runners/chainloopsandbox.go

@@ -92,8 +92,10 @@ func (r *ChainloopSandbox) VerifyCommitSignature(_ context.Context, commitHash s
 		return nil
 	}
 
+	// A verification without a status carries no result, the same as a missing one.
 	var given SandboxCommitVerification
-	if err := json.Unmarshal([]byte(raw), &given); err != nil || given.Verification == nil {
+	if err := json.Unmarshal([]byte(raw), &given); err != nil || given.Verification == nil ||
+		given.Verification.Status == commitverification.VerificationStatusUnspecified {
 		return &commitverification.CommitVerification{
 			Attempted: true,
 			Status:    commitverification.VerificationStatusUnavailable,

pkg/attestation/crafter/runners/chainloopsandbox_test.go

@@ -182,6 +182,18 @@ func (s *chainloopSandboxSuite) TestVerifyCommitSignature() {
 			commit: commit,
 			want:   invalid,
 		},
+		{
+			name:   "verification without a status",
+			env:    `{"commit":"` + commit + `","verification":{"attempted":true,"platform":"gitlab"}}`,
+			commit: commit,
+			want:   invalid,
+		},
+		{
+			name:   "unspecified status",
+			env:    `{"commit":"` + commit + `","verification":{"attempted":true,"status":"unspecified"}}`,
+			commit: commit,
+			want:   invalid,
+		},
 	}
 
 	for _, tc := range testCases {