feat: add --latest-version flag to attestation init

app/cli/cmd/attestation_init.go

@@ -35,6 +35,7 @@ func newAttestationInitCmd() *cobra.Command {
 		workflowName          string
 		projectName           string
 		projectVersion        string
+		useLatestVersion      bool
 		projectVersionRelease bool
 		existingVersion       bool
 		newWorkflowcontract   string
@@ -54,8 +55,8 @@ func newAttestationInitCmd() *cobra.Command {
 				return errors.New("workflow name is required, set it via --workflow flag")
 			}
 
-			// load version from the file if not set
-			if projectVersion == "" {
+			// load version from the file if not set and not using --latest-version
+			if projectVersion == "" && !useLatestVersion {
 				// load the cfg from the file
 				cfg, path, err := loadDotChainloopConfigWithParentTraversal()
 				// we do gracefully load, if not found, or any other error we continue
@@ -69,6 +70,10 @@ func newAttestationInitCmd() *cobra.Command {
 				projectVersion = cfg.ProjectVersion
 			}
 
+			if useLatestVersion && projectVersion != "" {
+				return errors.New("--latest-version and --version are mutually exclusive")
+			}
+
 			if projectVersion == "" && projectVersionRelease {
 				return errors.New("project version is required when using --release")
 			}
@@ -110,6 +115,7 @@ func newAttestationInitCmd() *cobra.Command {
 						ContractRevision:             contractRevision,
 						ProjectName:                  projectName,
 						ProjectVersion:               projectVersion,
+						UseLatestVersion:             useLatestVersion,
 						WorkflowName:                 workflowName,
 						NewWorkflowContractRef:       newWorkflowcontract,
 						ProjectVersionMarkAsReleased: projectVersionRelease,
@@ -172,6 +178,7 @@ func newAttestationInitCmd() *cobra.Command {
 	cmd.Flags().StringVar(&newWorkflowcontract, "contract", "", "name of an existing contract or the path/URL to a contract file, to attach it to the auto-created workflow (it doesn't update an existing one)")
 
 	cmd.Flags().StringVar(&projectVersion, "version", "", "project version, i.e 0.1.0")
+	cmd.Flags().BoolVar(&useLatestVersion, "latest-version", false, "use the latest existing project version instead of specifying one")
 	cmd.Flags().BoolVar(&projectVersionRelease, "release", false, "promote the provided version as a release")
 	cmd.Flags().BoolVar(&existingVersion, "existing-version", false, "return an error if the version doesn't exist in the project")
 	cmd.Flags().StringSliceVar(&collectors, "collectors", nil, "comma-separated list of additional collectors to enable (e.g. aiconfig)")

app/cli/documentation/cli-reference.mdx

@@ -327,6 +327,7 @@ Options
 --dry-run                 do not record attestation in the control plane, useful for development
 --existing-version        return an error if the version doesn't exist in the project
 -h, --help                    help for init
+--latest-version          use the latest existing project version instead of specifying one
 --project string          name of the project of this workflow
 --release                 promote the provided version as a release
 --remote-state            Store the attestation state remotely

app/cli/pkg/action/attestation_init.go

@@ -97,6 +97,7 @@ type AttestationInitRunOpts struct {
 	ContractRevision             int
 	ProjectName                  string
 	ProjectVersion               string
+	UseLatestVersion             bool
 	ProjectVersionMarkAsReleased bool
 	RequireExistingVersion       bool
 	WorkflowName                 string
@@ -170,7 +171,7 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 		ContractName:   workflow.ContractName,
 	}
 
-	if opts.ProjectVersion != "" {
+	if opts.ProjectVersion != "" || opts.UseLatestVersion {
 		workflowMeta.Version = &clientAPI.ProjectVersion{
 			Version:        opts.ProjectVersion,
 			MarkAsReleased: opts.ProjectVersionMarkAsReleased,
@@ -215,6 +216,7 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 				WorkflowName:           opts.WorkflowName,
 				ProjectName:            opts.ProjectName,
 				ProjectVersion:         opts.ProjectVersion,
+				UseLatestVersion:       opts.UseLatestVersion,
 				RequireExistingVersion: opts.RequireExistingVersion,
 			},
 		)
@@ -235,6 +237,7 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 		uiDashboardURL = result.GetUiDashboardUrl()
 
 		if v := workflowMeta.Version; v != nil && workflowRun.GetVersion() != nil {
+			v.Version = workflowRun.GetVersion().GetVersion()
 			v.Prerelease = workflowRun.GetVersion().GetPrerelease()
 		}
 

app/controlplane/api/controlplane/v1/workflow_run.proto

@@ -124,6 +124,9 @@ message AttestationServiceInitRequest {
   string project_version = 6;
   // Optional flag to require that the project version already exists
   bool require_existing_version = 7;
+  // Use the latest project version instead of specifying one explicitly.
+  // Mutually exclusive with project_version.
+  bool use_latest_version = 8;
 }
 
 message AttestationServiceInitResponse {

app/controlplane/internal/service/attestation.go

@@ -201,6 +201,7 @@ func (s *AttestationService) Init(ctx context.Context, req *cpAPI.AttestationSer
 		RunnerType:             req.GetRunner().String(),
 		CASBackendID:           backend.ID,
 		ProjectVersion:         req.GetProjectVersion(),
+		UseLatestVersion:       req.GetUseLatestVersion(),
 		RequireExistingVersion: req.GetRequireExistingVersion(),
 	}
 

app/controlplane/pkg/biz/version_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.

app/controlplane/pkg/biz/workflowrun.go

@@ -220,6 +220,7 @@ type WorkflowRunCreateOpts struct {
 	RunnerType             string
 	CASBackendID           uuid.UUID
 	ProjectVersion         string
+	UseLatestVersion       bool
 	RequireExistingVersion bool
 }
 
@@ -229,6 +230,7 @@ type WorkflowRunRepoCreateOpts struct {
 	Backends                     []uuid.UUID
 	LatestRevision, UsedRevision int
 	ProjectVersion               string
+	UseLatestVersion             bool
 	RequireExistingVersion       bool
 }
 
@@ -249,6 +251,10 @@ func (uc *WorkflowRunUseCase) Create(ctx context.Context, opts *WorkflowRunCreat
 
 	contractRevision := opts.ContractRevision
 
+	if opts.UseLatestVersion && opts.ProjectVersion != "" {
+		return nil, NewErrValidationStr("cannot specify both a project version and use-latest-version")
+	}
+
 	if opts.ProjectVersion != "" {
 		if err := ValidateVersion(opts.ProjectVersion); err != nil {
 			return nil, err
@@ -268,6 +274,7 @@ func (uc *WorkflowRunUseCase) Create(ctx context.Context, opts *WorkflowRunCreat
 			LatestRevision:         contractRevision.Contract.LatestRevision,
 			UsedRevision:           contractRevision.Version.Revision,
 			ProjectVersion:         opts.ProjectVersion,
+			UseLatestVersion:       opts.UseLatestVersion,
 			RequireExistingVersion: opts.RequireExistingVersion,
 		})
 	if err != nil {

app/controlplane/pkg/biz/workflowrun_integration_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -26,6 +26,7 @@ import (
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/biz"
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/biz/testhelpers"
 	attestation2 "github.com/chainloop-dev/chainloop/app/controlplane/pkg/data/ent/attestation"
+	entProjectVersion "github.com/chainloop-dev/chainloop/app/controlplane/pkg/data/ent/projectversion"
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/pagination"
 	"github.com/chainloop-dev/chainloop/pkg/attestation"
 	"github.com/chainloop-dev/chainloop/pkg/credentials"
@@ -339,6 +340,58 @@ func (s *workflowRunIntegrationTestSuite) TestCreate() {
 			s.Equal(pv.ID, run.ProjectVersion.ID)
 		}
 	})
+
+	s.T().Run("use-latest-version resolves to version with latest=true", func(_ *testing.T) {
+		// Create a named version first so we know which one is latest.
+		namedRun, err := s.WorkflowRun.Create(ctx, &biz.WorkflowRunCreateOpts{
+			WorkflowID: s.workflowOrg1.ID.String(), ContractRevision: s.contractVersion, CASBackendID: s.casBackend.ID,
+			RunnerType: "runnerType", RunnerRunURL: "runURL", ProjectVersion: "latest-target",
+		})
+		s.Require().NoError(err)
+		latestVersion := namedRun.ProjectVersion
+
+		// Now create a run with UseLatestVersion — should resolve to "latest-target"
+		run, err := s.WorkflowRun.Create(ctx, &biz.WorkflowRunCreateOpts{
+			WorkflowID: s.workflowOrg1.ID.String(), ContractRevision: s.contractVersion, CASBackendID: s.casBackend.ID,
+			RunnerType: "runnerType", RunnerRunURL: "runURL", UseLatestVersion: true,
+		})
+		s.Require().NoError(err)
+		s.Equal(latestVersion.ID, run.ProjectVersion.ID)
+		s.Equal("latest-target", run.ProjectVersion.Version)
+	})
+
+	s.T().Run("use-latest-version with no versions returns error", func(_ *testing.T) {
+		// Create a new workflow in a fresh project (which auto-creates a default version)
+		wf, err := s.Workflow.Create(ctx, &biz.WorkflowCreateOpts{
+			Name: "no-versions-workflow", OrgID: s.org.ID, Project: "empty-project",
+		})
+		s.Require().NoError(err)
+
+		// Delete all versions for this project so resolution fails
+		_, err = s.Data.DB.ProjectVersion.Delete().
+			Where(
+				entProjectVersion.ProjectID(wf.ProjectID),
+			).Exec(ctx)
+		s.Require().NoError(err)
+
+		_, err = s.WorkflowRun.Create(ctx, &biz.WorkflowRunCreateOpts{
+			WorkflowID: wf.ID.String(), ContractRevision: s.contractVersion, CASBackendID: s.casBackend.ID,
+			RunnerType: "runnerType", RunnerRunURL: "runURL", UseLatestVersion: true,
+		})
+		s.Require().Error(err)
+		s.True(biz.IsErrValidation(err))
+		s.Contains(err.Error(), "no project version exists")
+	})
+
+	s.T().Run("use-latest-version and project-version are mutually exclusive", func(_ *testing.T) {
+		_, err := s.WorkflowRun.Create(ctx, &biz.WorkflowRunCreateOpts{
+			WorkflowID: s.workflowOrg1.ID.String(), ContractRevision: s.contractVersion, CASBackendID: s.casBackend.ID,
+			RunnerType: "runnerType", RunnerRunURL: "runURL", ProjectVersion: "v1.0", UseLatestVersion: true,
+		})
+		s.Require().Error(err)
+		s.True(biz.IsErrValidation(err))
+		s.Contains(err.Error(), "cannot specify both")
+	})
 }
 
 func (s *workflowRunIntegrationTestSuite) TestContractInformation() {