feat(attestation): add --mark-latest flag to attestation init

app/cli/cmd/attestation_init.go

@@ -40,6 +40,7 @@ func newAttestationInitCmd() *cobra.Command {
 		existingVersion       bool
 		newWorkflowcontract   string
 		collectors            []string
+		markAsLatest          bool
 	)
 
 	cmd := &cobra.Command{
@@ -50,7 +51,7 @@ func newAttestationInitCmd() *cobra.Command {
 			supportsFederatedAuthAnnotation: trueString,
 			confirmWhenUserToken:            trueString,
 		},
-		PreRunE: func(_ *cobra.Command, _ []string) error {
+		PreRunE: func(cmd *cobra.Command, _ []string) error {
 			if workflowName == "" {
 				return errors.New("workflow name is required, set it via --workflow flag")
 			}
@@ -74,6 +75,10 @@ func newAttestationInitCmd() *cobra.Command {
 				return errors.New("--latest-version and --version are mutually exclusive")
 			}
 
+			if cmd.Flags().Changed("mark-latest") && useLatestVersion {
+				return errors.New("--mark-latest and --latest-version are mutually exclusive")
+			}
+
 			if projectVersion == "" && projectVersionRelease {
 				return errors.New("project version is required when using --release")
 			}
@@ -107,6 +112,11 @@ func newAttestationInitCmd() *cobra.Command {
 				return fmt.Errorf("failed to initialize attestation: %w", err)
 			}
 
+			var markAsLatestPtr *bool
+			if cmd.Flags().Changed("mark-latest") {
+				markAsLatestPtr = &markAsLatest
+			}
+
 			var attestationID string
 			err = runWithBackoffRetry(
 				func() error {
@@ -121,6 +131,7 @@ func newAttestationInitCmd() *cobra.Command {
 						ProjectVersionMarkAsReleased: projectVersionRelease,
 						RequireExistingVersion:       existingVersion,
 						Collectors:                   collectors,
+						MarkAsLatest:                 markAsLatestPtr,
 					})
 
 					return err
@@ -182,6 +193,7 @@ func newAttestationInitCmd() *cobra.Command {
 	cmd.Flags().BoolVar(&projectVersionRelease, "release", false, "promote the provided version as a release")
 	cmd.Flags().BoolVar(&existingVersion, "existing-version", false, "return an error if the version doesn't exist in the project")
 	cmd.Flags().StringSliceVar(&collectors, "collectors", nil, "comma-separated list of additional collectors to enable (e.g. aiconfig)")
+	cmd.Flags().BoolVar(&markAsLatest, "mark-latest", true, "explicitly mark the project version as latest (default: automatic for new versions; use =false to skip promotion)")
 
 	return cmd
 }

app/cli/documentation/cli-reference.mdx

@@ -328,6 +328,7 @@ Options
 --existing-version        return an error if the version doesn't exist in the project
 -h, --help                    help for init
 --latest-version          use the latest existing project version instead of specifying one
+--mark-latest             explicitly mark the project version as latest (default: automatic for new versions; use =false to skip promotion) (default true)
 --project string          name of the project of this workflow
 --release                 promote the provided version as a release
 --remote-state            Store the attestation state remotely

app/cli/pkg/action/attestation_init.go

@@ -103,7 +103,8 @@ type AttestationInitRunOpts struct {
 	WorkflowName                 string
 	NewWorkflowContractRef       string
 	// Collectors is a list of additional collector names to enable (e.g. "aiconfig")
-	Collectors []string
+	Collectors   []string
+	MarkAsLatest *bool
 }
 
 func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRunOpts) (string, error) {
@@ -218,6 +219,7 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 				ProjectVersion:         opts.ProjectVersion,
 				UseLatestVersion:       opts.UseLatestVersion,
 				RequireExistingVersion: opts.RequireExistingVersion,
+				MarkAsLatest:           opts.MarkAsLatest,
 			},
 		)
 		if err != nil {

app/controlplane/api/controlplane/v1/response_messages.proto

@@ -87,6 +87,7 @@ message ProjectVersion {
   google.protobuf.Timestamp created_at = 4;
   // when it was marked as released
   google.protobuf.Timestamp released_at = 5;
+  bool latest = 6;
 }
 
 enum RunStatus {

app/controlplane/api/controlplane/v1/workflow_run.proto

@@ -127,6 +127,12 @@ message AttestationServiceInitRequest {
   // Use the latest project version instead of specifying one explicitly.
   // Mutually exclusive with project_version.
   bool use_latest_version = 8;
+  // Optional flag to control whether the version should be marked as the latest.
+  // Omitted: default behavior (new versions become latest).
+  // true: force promote to latest (only pre-release versions).
+  // false: skip latest promotion.
+  // Mutually exclusive with use_latest_version.
+  optional bool mark_as_latest = 9;
 }
 
 message AttestationServiceInitResponse {