Expose pipeline profile selection and provenance

internal/config/effective_digest.go

@@ -10,6 +10,31 @@ import (
 
 const pipelineDefaultOwnershipSource = "default"
 
+// PipelineProfileProvenance identifies the profile selected while resolving a
+// pipeline. It contains only non-secret selection metadata.
+type PipelineProfileProvenance struct {
+	Name   string
+	Source string
+}
+
+// SelectedPipelineProfile reports the profile used to resolve cfg, if any.
+func SelectedPipelineProfile(cfg *PipelineConfig) (*PipelineProfileProvenance, bool) {
+	if cfg == nil || cfg.resolution == nil || cfg.resolution.selectedProfile == nil {
+		return nil, false
+	}
+	selection := cfg.resolution.selectedProfile
+	return &PipelineProfileProvenance{Name: selection.name, Source: selection.source}, true
+}
+
+// EffectivePipelineDigest reports the deterministic secret-free digest for a
+// resolved pipeline.
+func EffectivePipelineDigest(cfg *PipelineConfig) string {
+	if cfg == nil || cfg.resolution == nil {
+		return ""
+	}
+	return cfg.resolution.effectiveDigest
+}
+
 func finalizePipelineResolution(cfg *PipelineConfig) error {
 	if cfg == nil || cfg.resolution == nil {
 		return fmt.Errorf("pipeline resolution metadata is required")