Record reference provenance in manifests

internal/framework/pipeline/runner_test.go

@@ -960,7 +960,27 @@ func TestRunReturnsFailedManifestWhenOutputEncoderFails(t *testing.T) {
 }
 
 func TestRunManifestIncludesPipelineAndLaneDetails(t *testing.T) {
-	output, err := New(newRunnerRegistries(t, nil)).Run(context.Background(), RunInput{Pipeline: resolvedPipelineWithValidators("configured")})
+	resolved := resolvedPipelineWithValidators("configured")
+	resolved.ArtifactLanes[0].ReferenceSet = contracts.ReferenceSet{
+		Slots: map[string]contracts.ResolvedReferenceSlot{
+			"roster": {
+				Slot: contracts.ReferenceSlot{Name: "roster"},
+				Items: []contracts.ReferenceItem{
+					{
+						SlotName:      "roster",
+						MediaType:     "text/plain; charset=utf-8",
+						Content:       []byte("reference content"),
+						Digest:        "sha256:reference",
+						Origin:        contracts.ReferenceOrigin{Type: "file", URI: "file:///tmp/roster.txt"},
+						SizeBytes:     int64(len("reference content")),
+						BindingSource: contracts.ReferenceBindingSourceConfig,
+					},
+				},
+			},
+		},
+	}
+
+	output, err := New(newRunnerRegistries(t, nil)).Run(context.Background(), RunInput{Pipeline: resolved})
 	if err != nil {
 		t.Fatalf("Run() error = %v, want nil", err)
 	}
@@ -975,6 +995,16 @@ func TestRunManifestIncludesPipelineAndLaneDetails(t *testing.T) {
 	if !reflect.DeepEqual(manifest.SourceDigests, []string{"sha256:source"}) {
 		t.Fatalf("SourceDigests = %#v, want source digest", manifest.SourceDigests)
 	}
+	if len(manifest.References) != 1 {
+		t.Fatalf("References = %#v, want one reference provenance entry", manifest.References)
+	}
+	reference := manifest.References[0]
+	if reference.LaneID != "alpha" || reference.SlotName != "roster" || reference.Digest != "sha256:reference" {
+		t.Fatalf("reference provenance = %#v, want lane slot digest", reference)
+	}
+	if reference.OriginType != "file" || reference.OriginURI != "file:///tmp/roster.txt" || reference.MediaType != "text/plain; charset=utf-8" || reference.SizeBytes != int64(len("reference content")) || reference.BindingSource != contracts.ReferenceBindingSourceConfig {
+		t.Fatalf("reference provenance = %#v, want origin/media/size/source", reference)
+	}
 	if manifest.ValidationStatus != "approved" {
 		t.Fatalf("ValidationStatus = %q, want approved", manifest.ValidationStatus)
 	}