{"record":{"id":"37c2a5e0e7b4fd9a","repo":"cli/cli","slug":"failed-to-unmarshal-predicate-v","errorCode":null,"errorMessage":"failed to unmarshal predicate: %v","messagePattern":"failed to unmarshal predicate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/attestation/inspect/bundle.go","lineNumber":96,"sourceCode":"\tenvelope, err := attr.Bundle.Envelope()\n\tif err != nil {\n\t\treturn AttestationDetail{}, fmt.Errorf(\"failed to get envelope from bundle: %v\", err)\n\t}\n\n\tstatement, err := envelope.EnvelopeContent().Statement()\n\tif err != nil {\n\t\treturn AttestationDetail{}, fmt.Errorf(\"failed to get statement from envelope: %v\", err)\n\t}\n\n\tvar predicate Predicate\n\tpredicateJson, err := json.Marshal(statement.Predicate)\n\tif err != nil {\n\t\treturn AttestationDetail{}, fmt.Errorf(\"failed to marshal predicate: %v\", err)\n\t}\n\n\terr = json.Unmarshal(predicateJson, &predicate)\n\tif err != nil {\n\t\treturn AttestationDetail{}, fmt.Errorf(\"failed to unmarshal predicate: %v\", err)\n\t}\n\n\torg, repo, err := getOrgAndRepo(tenant, predicate.BuildDefinition.ExternalParameters.Workflow.Repository)\n\tif err != nil {\n\t\treturn AttestationDetail{}, fmt.Errorf(\"failed to parse attestation content: %v\", err)\n\t}\n\n\treturn AttestationDetail{\n\t\tOrgName:        org,\n\t\tOrgID:          predicate.BuildDefinition.InternalParameters.GitHub.RepositoryOwnerId,\n\t\tRepositoryName: repo,\n\t\tRepositoryID:   predicate.BuildDefinition.InternalParameters.GitHub.RepositoryID,\n\t\tWorkflowID:     predicate.RunDetails.Metadata.InvocationID,\n\t}, nil\n}\n","sourceCodeStart":78,"sourceCodeEnd":112,"githubUrl":"https://github.com/cli/cli/blob/0eeec0b92edbe70199f9768522f831d3534f41ad/pkg/cmd/attestation/inspect/bundle.go#L78-L112","documentation":"Thrown when json.Unmarshal(predicateJson, &predicate) fails: the statement's predicate JSON does not fit the expected Predicate schema (BuildDefinition.ExternalParameters.Workflow, InternalParameters.GitHub, RunDetails.Metadata fields). This is the realistic schema-mismatch error of the marshal/unmarshal pair.","triggerScenarios":"A predicate whose buildDefinition or runDetails differs structurally from what the Predicate struct expects, e.g. missing workflow.externalParameters or unexpected JSON types (string where object expected).","commonSituations":"Custom predicates (not provenance), newer SLSA predicate layouts, or third-party signed statements run through `gh attestation inspect`.","solutions":["Use `gh attestation inspect` output or jq on the bundle to view the predicate's actual shape","Upgrade gh to a release matching the artifact's predicate version","Note that non-provenance attestations may not carry workflow fields this code expects"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"raw, _ := json.Marshal(statement.Predicate)\nvar probe map[string]any\nif err := json.Unmarshal(raw, &probe); err != nil {\n\treturn errors.New(\"predicate is not valid JSON\")\n}\nbd, ok := probe[\"buildDefinition\"].(map[string]any)\nif !ok { return errors.New(\"predicate lacks buildDefinition; not a provenance attestation\") }","typeGuard":"func isProvenancePredicate(stmt *intoto.Statement) bool {\n\treturn stmt.PredicateType == \"https://slsa.dev/provenance/v1\" ||\n\t\tstmt.PredicateType == \"https://slsa.dev/provenance/v0.2\"\n}","tryCatchPattern":"if err := json.Unmarshal(predicateJson, &predicate); err != nil {\n\treturn fmt.Errorf(\"predicate schema mismatch (type %s): %w\", statement.PredicateType, err)\n}","preventionTips":["Check the statement's predicateType is a provenance type before inspecting details","Expect non-provenance attestations to lack workflow fields","Upgrade gh when newer SLSA predicate versions ship"],"tags":["attestation","json","schema","predicate"],"backgroundTag":null,"analyzedSha":"0eeec0b92edbe70199f9768522f831d3534f41ad","analyzedAt":"2026-08-15T12:31:05.478Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}