feat(cli): improve evaluation reasoning output using existing fields

cmd/cli/app/artifact/artifact_get.go

@@ -14,10 +14,10 @@ import (
 
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
-	"google.golang.org/grpc"
 	"google.golang.org/protobuf/reflect/protoreflect"
 
 	"github.com/mindersec/minder/cmd/cli/app"
+	"github.com/mindersec/minder/cmd/cli/app/profile"
 	"github.com/mindersec/minder/internal/util"
 	"github.com/mindersec/minder/internal/util/cli"
 	"github.com/mindersec/minder/internal/util/cli/table"
@@ -30,12 +30,28 @@ var getCmd = &cobra.Command{
 	Use:   "get",
 	Short: "Get artifact details",
 	Long:  `The artifact get subcommand will get artifact details from an artifact, for a given ID.`,
-	RunE:  cli.GRPCClientWrapRunE(getCommand),
+	RunE:  getCommand,
 }
 
 // getCommand is the artifact get subcommand
-func getCommand(ctx context.Context, cmd *cobra.Command, _ []string, conn *grpc.ClientConn) error {
-	client := minderv1.NewArtifactServiceClient(conn)
+func getCommand(cmd *cobra.Command, _ []string) error {
+	if err := viper.BindPFlags(cmd.Flags()); err != nil {
+		return fmt.Errorf("error binding flags: %w", err)
+	}
+
+	client, cleanup, err := cli.GetCLIClient(cmd, minderv1.NewArtifactServiceClient)
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	profileClient, profileCleanup, err := cli.GetCLIClient(cmd, minderv1.NewProfileServiceClient)
+	if err != nil {
+		return err
+	}
+	defer profileCleanup()
+
+	ctx := cmd.Context()
 
 	provider := viper.GetString("provider")
 	project := viper.GetString("project")
@@ -61,7 +77,7 @@ func getCommand(ctx context.Context, cmd *cobra.Command, _ []string, conn *grpc.
 		return cli.MessageAndError("Error printing artifact", err)
 	}
 
-	evalStatus, err := artifactEvalStatus(ctx, conn, art, provider, project)
+	evalStatus, err := artifactEvalStatus(ctx, profileClient, art, provider, project)
 	if err != nil {
 		return cli.MessageAndError("Error getting artifact evaluation status", err)
 	}
@@ -113,12 +129,12 @@ func artifactGet(
 }
 
 func artifactEvalStatus(
-	ctx context.Context, conn *grpc.ClientConn,
+	ctx context.Context,
+	client minderv1.ProfileServiceClient,
 	artifact *minderv1.Artifact,
 	provider, project string,
 ) ([]*minderv1.RuleEvaluationStatus, error) {
-	profClient := minderv1.NewProfileServiceClient(conn)
-	profiles, err := profClient.ListProfiles(ctx, &minderv1.ListProfilesRequest{
+	profiles, err := client.ListProfiles(ctx, &minderv1.ListProfilesRequest{
 		Context: &minderv1.Context{
 			Provider: &provider,
 			Project:  &project,
@@ -130,20 +146,20 @@ func artifactEvalStatus(
 
 	var respList []*minderv1.RuleEvaluationStatus
 
-	for _, profile := range profiles.Profiles {
+	for _, prof := range profiles.Profiles {
 		req := &minderv1.GetProfileStatusByNameRequest{
 			Context: &minderv1.Context{
 				Provider: &provider,
 				Project:  &project,
 			},
-			Name: profile.GetName(),
+			Name: prof.GetName(),
 			Entity: &minderv1.EntityTypedId{
 				Id:   artifact.ArtifactPk,
 				Type: minderv1.Entity_ENTITY_ARTIFACTS,
 			},
 		}
 
-		resp, err := profClient.GetProfileStatusByName(ctx, req)
+		resp, err := client.GetProfileStatusByName(ctx, req)
 		if err != nil {
 			return nil, cli.MessageAndError("Error getting profile status", err)
 		}
@@ -190,16 +206,23 @@ func printArtifact(
 func printEvalStatus(
 	cmd *cobra.Command, evalStatus []*minderv1.RuleEvaluationStatus, format string,
 ) error {
+	if len(evalStatus) == 0 {
+		return nil
+	}
+
 	switch format {
 	case app.Table:
 		ta := table.New(table.Simple, layouts.Default, cmd.OutOrStdout(),
-			[]string{"Profile", "Rule", "Status", "Message"})
+			[]string{"Profile", "Rule", "Result", "Details"})
 		for _, status := range evalStatus {
+			ruleName := profile.RuleDisplayName(status)
+			reasoning := profile.FormatEvaluationReasoning(status)
+
 			ta.AddRow(
 				status.ProfileId,
-				status.RuleTypeName,
+				ruleName,
 				status.Status,
-				status.Details,
+				reasoning,
 			)
 		}
 		ta.Render()

cmd/cli/app/artifact/artifact_get_test.go

@@ -0,0 +1,93 @@
+// SPDX-FileCopyrightText: Copyright 2026 The Minder Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package artifact
+
+// JSON output is not tested because protojson formatting is not stable across environments.
+// This can cause flaky tests due to spacing differences.
+// See maintainer discussion in PR #6417.
+
+import (
+	"context"
+	"testing"
+
+	"go.uber.org/mock/gomock"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/mindersec/minder/internal/util/cli"
+	minderv1 "github.com/mindersec/minder/pkg/api/protobuf/go/minder/v1"
+	mockv1 "github.com/mindersec/minder/pkg/api/protobuf/go/minder/v1/mock"
+)
+
+//nolint:paralleltest // Cannot run in parallel because it swaps global Viper/Stdout state
+func TestArtifactGetCommand(t *testing.T) {
+	setupSuccess := func(t *testing.T, ctrl *gomock.Controller) context.Context {
+		t.Helper()
+
+		artifactClient := mockv1.NewMockArtifactServiceClient(ctrl)
+		profileClient := mockv1.NewMockProfileServiceClient(ctrl)
+
+		artifactResp := &minderv1.GetArtifactByIdResponse{}
+		cli.LoadFixture(t, "mock_artifact_get.json", artifactResp)
+
+		artifactClient.EXPECT().
+			GetArtifactById(gomock.Any(), gomock.Any()).
+			Return(artifactResp, nil).
+			Times(1)
+
+		listProfilesResp := &minderv1.ListProfilesResponse{}
+		cli.LoadFixture(t, "mock_list_profiles.json", listProfilesResp)
+		profileClient.EXPECT().
+			ListProfiles(gomock.Any(), gomock.Any()).
+			Return(listProfilesResp, nil).
+			Times(1)
+
+		statusResp := &minderv1.GetProfileStatusByNameResponse{}
+		cli.LoadFixture(t, "mock_profile_status.json", statusResp)
+		profileClient.EXPECT().
+			GetProfileStatusByName(gomock.Any(), gomock.Any()).
+			Return(statusResp, nil).
+			Times(1)
+
+		ctx := cli.WithRPCClient[minderv1.ArtifactServiceClient](context.Background(), artifactClient)
+		ctx = cli.WithRPCClient[minderv1.ProfileServiceClient](ctx, profileClient)
+		return ctx
+	}
+
+	tests := []cli.CmdTestCase{
+		{
+			Name:           "get artifact - table output",
+			Args:           []string{"artifact", "get", "-i", "111", "-o", "table"},
+			MockSetup:      setupSuccess,
+			GoldenFileName: "artifact_get.table",
+		},
+		{
+			Name:           "get artifact - yaml output",
+			Args:           []string{"artifact", "get", "-i", "111", "-o", "yaml"},
+			MockSetup:      setupSuccess,
+			GoldenFileName: "artifact_get.yaml",
+		},
+		{
+			Name: "server error handling",
+			Args: []string{"artifact", "get", "-i", "111"},
+			MockSetup: func(t *testing.T, ctrl *gomock.Controller) context.Context {
+				t.Helper()
+				artifactClient := mockv1.NewMockArtifactServiceClient(ctrl)
+				profileClient := mockv1.NewMockProfileServiceClient(ctrl)
+
+				artifactClient.EXPECT().
+					GetArtifactById(gomock.Any(), gomock.Any()).
+					Return(nil, status.Error(codes.NotFound, "artifact not found")).
+					Times(1)
+
+				ctx := cli.WithRPCClient[minderv1.ArtifactServiceClient](context.Background(), artifactClient)
+				ctx = cli.WithRPCClient[minderv1.ProfileServiceClient](ctx, profileClient)
+				return ctx
+			},
+			ExpectedError: "artifact not found",
+		},
+	}
+
+	cli.RunCmdTests(t, tests, ArtifactCmd)
+}

cmd/cli/app/artifact/fixture/mock_artifact_get.json

@@ -0,0 +1,11 @@
+{
+  "artifact": {
+    "artifactPk": "111",
+    "name": "artifact-1",
+    "type": "image",
+    "owner": "owner-1",
+    "repository": "org/repo",
+    "visibility": "public",
+    "createdAt": "2024-01-02T15:04:05Z"
+  }
+}

cmd/cli/app/artifact/fixture/mock_list_profiles.json

@@ -0,0 +1,7 @@
+{
+  "profiles": [
+    {
+      "name": "artifact-security-baseline"
+    }
+  ]
+}

cmd/cli/app/artifact/fixture/mock_profile_status.json

@@ -0,0 +1,31 @@
+{
+  "profile_status": {
+    "profile_id": "artifact-security-baseline",
+    "profile_name": "artifact-security-baseline",
+    "profile_status": "failure",
+    "last_updated": "2024-01-01T00:00:00Z"
+  },
+  "rule_evaluation_status": [
+    {
+      "profile_id": "artifact-security-baseline",
+      "rule_id": "artifact-attestation-slsa",
+      "entity": "artifact",
+      "status": "failure",
+      "last_updated": "2024-01-01T00:00:00Z",
+      "entity_info": {
+        "name": "owner-1/artifact-1"
+      },
+      "details": "artifact attestation is disabled for this image",
+      "guidance": "enable artifact attestations before release",
+      "remediation_details": "rebuild the artifact with attestations enabled",
+      "remediation_url": "https://example.com/remediate/artifact-111",
+      "rule_type_name": "artifact_attestation_slsa",
+      "rule_description_name": "Require artifact attestation",
+      "alert": {
+        "status": "on",
+        "details": "artifact attestation alert is active",
+        "url": "https://example.com/alerts/artifact-111"
+      }
+    }
+  ]
+}

cmd/cli/app/artifact/testdata/artifact_get.table.golden

@@ -0,0 +1,17 @@
+ ID    │ TYPE   │ OWNER    │ NAME         │ REPOSITORY   │ VISIBILITY   │ CREATION DATE             
+───────┼────────┼──────────┼──────────────┼──────────────┼──────────────┼───────────────────────────
+ 111   │ image  │ owner-1  │ artifact-1   │ org/repo     │ public       │ 2024-01-02T15:04:05Z      
+ PROFILE                    │ RULE                         │ RESULT  │ DETAILS                      
+────────────────────────────┼──────────────────────────────┼─────────┼──────────────────────────────
+ artifact-security-baseline │ Require artifact attestation │ failure │ Alert: artifact attestation  
+                            │                              │         │ alert is active URL:         
+                            │                              │         │ https://example.com/alerts/a 
+                            │                              │         │ rtifact-111 Remediation:     
+                            │                              │         │ rebuild the artifact with    
+                            │                              │         │ attestations enabled URL:    
+                            │                              │         │ https://example.com/remediat 
+                            │                              │         │ e/artifact-111 Details:      
+                            │                              │         │ artifact attestation is      
+                            │                              │         │ disabled for this image      
+                            │                              │         │ Guidance: enable artifact    
+                            │                              │         │ attestations before release  

cmd/cli/app/artifact/testdata/artifact_get.yaml.golden

@@ -0,0 +1,27 @@
+artifact:
+  artifactPk: "111"
+  createdAt: "2024-01-02T15:04:05Z"
+  name: artifact-1
+  owner: owner-1
+  repository: org/repo
+  type: image
+  visibility: public
+
+- alert:
+    details: artifact attestation alert is active
+    status: "on"
+    url: https://example.com/alerts/artifact-111
+  details: artifact attestation is disabled for this image
+  entity: artifact
+  entityInfo:
+    name: owner-1/artifact-1
+  guidance: enable artifact attestations before release
+  lastUpdated: "2024-01-01T00:00:00Z"
+  profileId: artifact-security-baseline
+  remediationDetails: rebuild the artifact with attestations enabled
+  remediationUrl: https://example.com/remediate/artifact-111
+  ruleDescriptionName: Require artifact attestation
+  ruleId: artifact-attestation-slsa
+  ruleTypeName: artifact_attestation_slsa
+  status: failure
+

cmd/cli/app/profile/status/status_get_test.go

@@ -80,24 +80,6 @@ func TestStatusGetCommand(t *testing.T) {
 			},
 			GoldenFileName: "status_get_uuid_entity.txt",
 		},
-		{
-			Name: "status get json output",
-			Args: []string{"profile", "status", "get", "-i", testId, "-e", testEntityName, "-t", testEntityType, "-o", "json"},
-			MockSetup: func(t *testing.T, ctrl *gomock.Controller) context.Context {
-				t.Helper()
-				client := mockv1.NewMockProfileServiceClient(ctrl)
-
-				mockResp := &minderv1.GetProfileStatusByIdResponse{}
-				cli.LoadFixture(t, "mock_profile_status.json", mockResp)
-
-				client.EXPECT().
-					GetProfileStatusById(gomock.Any(), gomock.Any()).
-					Return(mockResp, nil)
-
-				return cli.WithRPCClient[minderv1.ProfileServiceClient](context.Background(), client)
-			},
-			GoldenFileName: "status_get.json",
-		},
 		{
 			Name: "status get yaml output",
 			Args: []string{"profile", "status", "get", "-n", testName, "-e", testEntityName, "-t", testEntityType, "-o", "yaml"},

cmd/cli/app/profile/status/status_list_test.go

@@ -130,24 +130,6 @@ func TestStatusListCommand(t *testing.T) {
 			},
 			GoldenFileName: "status_list_filter_ruletype.txt",
 		},
-		{
-			Name: "status list json success",
-			Args: []string{"profile", "status", "list", "-n", testName, "-o", "json"},
-			MockSetup: func(t *testing.T, ctrl *gomock.Controller) context.Context {
-				t.Helper()
-				client := mockv1.NewMockProfileServiceClient(ctrl)
-
-				mockResp := &minderv1.GetProfileStatusByNameResponse{}
-				cli.LoadFixture(t, "mock_profile_status.json", mockResp)
-
-				client.EXPECT().
-					GetProfileStatusByName(gomock.Any(), gomock.Any()).
-					Return(mockResp, nil)
-
-				return cli.WithRPCClient[minderv1.ProfileServiceClient](context.Background(), client)
-			},
-			GoldenFileName: "status_list.json",
-		},
 		{
 			Name: "status list yaml success",
 			Args: []string{"profile", "status", "list", "-n", testName, "-o", "yaml"},