feat(container): surface provenance attestations behind feature flag [PRIM-100]

[bdemeo12]

What

Surfaces container image provenance attestations through the CLI, gated behind a feature flag.

• Bumps snyk-docker-plugin ^9.16.0 → ^9.18.0, which adds provenance attestation extraction (emits the provenanceMetadata fact).
• Gates that fact behind the surfaceProvenanceAttestations feature flag in filterDockerFacts, mirroring the existing allowNewContainerFacts pattern. When the flag is off, provenanceMetadata is filtered out before facts are sent downstream; when on, it is forwarded to Registry for upsert.

The provenance flag is independent of allowNewContainerFacts so it can be rolled out separately.

Changes

• package.json / package-lock.json — bump snyk-docker-plugin to ^9.18.0.
• src/cli/commands/constants.ts — add SURFACE_PROVENANCE_ATTESTATIONS_FEATURE_FLAG = 'surfaceProvenanceAttestations'.
• src/lib/ecosystems/common.ts — in filterDockerFacts, filter provenanceMetadata unless the flag is enabled.

Feature flag

surfaceProvenanceAttestations — defined in registry (snyk/registry#44819).

Downstream

This is the CLI half of the end-to-end provenance work. Registry relays the fact and assets-api persists it.

Notes

n/a

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	You've modified files in src/ directory, but haven't updated anything in test folder. Is there something that could be tested?
⚠️	There are multiple commits on your branch, please squash them locally before merging!
⚠️	"[feat(container): surface provenance attestations behind feature flag PRIM-100](#7047)" is too long. Keep the first line of your commit message under 72 characters.
⚠️	"[feat(container): surface provenance attestations behind feature flag PRIM-100](https://api.github.com/repos/snyk/cli/git/commits/394b331b76573ca183afc8937e32d089916e7cd5)" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against 805f667

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Version Mismatch 🟡 [minor] The PR description states that snyk-docker-plugin is being bumped to ^9.18.0, but the actual changes in package.json and package-lock.json bump it to ^9.20.0. While likely intentional to include more recent fixes, it contradicts the stated scope of the PR. "snyk-docker-plugin": "^9.20.0",

📚 Repository Context Analyzed This review considered 7 relevant code sections from 4 files (average relevance: 0.56) package.json (lines 1-236) package-lock.json (4 segments, lines 19475-19770) src/lib/ecosystems/common.ts (lines 1-89) src/cli/commands/constants.ts (lines 1-15)

🤖 Repository instructions applied (from AGENTS.md)