feat(cas-backend): introduce fallback mechanism

app/cli/cmd/casbackend.go

@@ -25,6 +25,7 @@ import (
 
 var (
 	isDefaultCASBackendUpdateOption   *bool
+	isFallbackCASBackendUpdateOption  *bool
 	descriptionCASBackendUpdateOption *string
 	maxBytesCASBackendOption          string
 	parsedMaxBytes                    *int64
@@ -47,6 +48,7 @@ func newCASBackendAddCmd() *cobra.Command {
 	}
 
 	cmd.PersistentFlags().Bool("default", false, "set the backend as default in your organization")
+	cmd.PersistentFlags().Bool("fallback", false, "set the backend as fallback in your organization")
 	cmd.PersistentFlags().String("description", "", "descriptive information for this registration")
 	cmd.PersistentFlags().String("name", "", "CAS backend name")
 	cmd.PersistentFlags().StringVar(&maxBytesCASBackendOption, "max-bytes", "", "Maximum size for each blob stored in this backend (e.g., 100MB, 1GB)")
@@ -60,10 +62,11 @@ func newCASBackendAddCmd() *cobra.Command {
 func newCASBackendUpdateCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "update",
-		Short: "Update a CAS backend description, credentials, default status, or max bytes",
+		Short: "Update a CAS backend description, credentials, default status, fallback status, or max bytes",
 	}
 
 	cmd.PersistentFlags().Bool("default", false, "set the backend as default in your organization")
+	cmd.PersistentFlags().Bool("fallback", false, "set the backend as fallback in your organization")
 	cmd.PersistentFlags().String("description", "", "descriptive information for this registration")
 	cmd.PersistentFlags().String("name", "", "CAS backend name")
 	cmd.PersistentFlags().StringVar(&maxBytesCASBackendOption, "max-bytes", "", "Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.")
@@ -148,7 +151,7 @@ func parseMaxBytesOption() error {
 	return nil
 }
 
-// captureUpdateFlags reads the --default and --description flags only when explicitly set and
+// captureUpdateFlags reads the --default, --fallback, and --description flags only when explicitly set and
 // stores their values in the package-level pointer options. This avoids treating their zero
 // values as an intention to update.
 func captureUpdateFlags(cmd *cobra.Command) error {
@@ -160,6 +163,14 @@ func captureUpdateFlags(cmd *cobra.Command) error {
 		isDefaultCASBackendUpdateOption = &v
 	}
 
+	if f := cmd.Flags().Lookup("fallback"); f != nil && f.Changed {
+		v, err := cmd.Flags().GetBool("fallback")
+		if err != nil {
+			return err
+		}
+		isFallbackCASBackendUpdateOption = &v
+	}
+
 	if f := cmd.Flags().Lookup("description"); f != nil && f.Changed {
 		v, err := cmd.Flags().GetString("description")
 		if err != nil {

app/cli/cmd/casbackend_add_azureblob.go

@@ -39,6 +39,9 @@ func newCASBackendAddAzureBlobStorageCmd() *cobra.Command {
 			isDefault, err := cmd.Flags().GetBool("default")
 			cobra.CheckErr(err)
 
+			isFallback, err := cmd.Flags().GetBool("fallback")
+			cobra.CheckErr(err)
+
 			name, err := cmd.Flags().GetString("name")
 			cobra.CheckErr(err)
 
@@ -70,6 +73,7 @@ func newCASBackendAddAzureBlobStorageCmd() *cobra.Command {
 					"clientSecret": clientSecret,
 				},
 				Default:  isDefault,
+				Fallback: isFallback,
 				MaxBytes: parsedMaxBytes,
 			}
 

app/cli/cmd/casbackend_add_oci.go

@@ -36,6 +36,9 @@ func newCASBackendAddOCICmd() *cobra.Command {
 			isDefault, err := cmd.Flags().GetBool("default")
 			cobra.CheckErr(err)
 
+			isFallback, err := cmd.Flags().GetBool("fallback")
+			cobra.CheckErr(err)
+
 			name, err := cmd.Flags().GetString("name")
 			cobra.CheckErr(err)
 
@@ -60,6 +63,7 @@ func newCASBackendAddOCICmd() *cobra.Command {
 					"password": password,
 				},
 				Default:  isDefault,
+				Fallback: isFallback,
 				MaxBytes: parsedMaxBytes,
 			}
 

app/cli/cmd/casbackend_add_s3.go

@@ -37,6 +37,9 @@ func newCASBackendAddAWSS3Cmd() *cobra.Command {
 			isDefault, err := cmd.Flags().GetBool("default")
 			cobra.CheckErr(err)
 
+			isFallback, err := cmd.Flags().GetBool("fallback")
+			cobra.CheckErr(err)
+
 			name, err := cmd.Flags().GetString("name")
 			cobra.CheckErr(err)
 
@@ -69,6 +72,7 @@ func newCASBackendAddAWSS3Cmd() *cobra.Command {
 					"region":          region,
 				},
 				Default:  isDefault,
+				Fallback: isFallback,
 				MaxBytes: parsedMaxBytes,
 			}
 

app/cli/cmd/casbackend_list.go

@@ -58,7 +58,7 @@ func casBackendListTableOutput(backends []*action.CASBackendItem) error {
 	}
 
 	t := output.NewTableWriter()
-	header := table.Row{"Name", "Location", "Provider", "Description", "Limits", "Default", "Status"}
+	header := table.Row{"Name", "Location", "Provider", "Description", "Limits", "Default", "Fallback", "Status"}
 	if full {
 		header = append(header, "Created At", "Validated At")
 	}
@@ -75,7 +75,7 @@ func casBackendListTableOutput(backends []*action.CASBackendItem) error {
 			validationStatus = strings.Join([]string{validationStatus, wrap.String(*b.ValidationError, 50)}, "\n")
 		}
 
-		r := table.Row{b.Name, wrap.String(b.Location, 35), b.Provider, wrap.String(b.Description, 35), limits, b.Default, validationStatus}
+		r := table.Row{b.Name, wrap.String(b.Location, 35), b.Provider, wrap.String(b.Description, 35), limits, b.Default, b.Fallback, validationStatus}
 		if full {
 			r = append(r, b.CreatedAt.Format(time.RFC822), b.ValidatedAt.Format(time.RFC822))
 		}

app/cli/cmd/casbackend_update_azureblob.go

@@ -53,6 +53,7 @@ func newCASBackendUpdateAzureBlobCmd() *cobra.Command {
 					"clientSecret": clientSecret,
 				},
 				Default:  isDefaultCASBackendUpdateOption,
+				Fallback: isFallbackCASBackendUpdateOption,
 				MaxBytes: parsedMaxBytes,
 			}
 

app/cli/cmd/casbackend_update_inline.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -26,7 +26,7 @@ func newCASBackendUpdateInlineCmd() *cobra.Command {
 	var backendName string
 	cmd := &cobra.Command{
 		Use:   "inline",
-		Short: "Update the Inline, fallback CAS Backend description or default status",
+		Short: "Update the Inline CAS Backend description, default status, or fallback status",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			// capture flags only when explicitly set
 			if err := captureUpdateFlags(cmd); err != nil {
@@ -45,6 +45,7 @@ func newCASBackendUpdateInlineCmd() *cobra.Command {
 				Name:        backendName,
 				Description: descriptionCASBackendUpdateOption,
 				Default:     isDefaultCASBackendUpdateOption,
+				Fallback:    isFallbackCASBackendUpdateOption,
 			}
 
 			res, err := action.NewCASBackendUpdate(ActionOpts).Run(opts)

app/cli/cmd/casbackend_update_oci.go

@@ -52,6 +52,7 @@ func newCASBackendUpdateOCICmd() *cobra.Command {
 					"password": password,
 				},
 				Default:  isDefaultCASBackendUpdateOption,
+				Fallback: isFallbackCASBackendUpdateOption,
 				MaxBytes: parsedMaxBytes,
 			}
 

app/cli/cmd/casbackend_update_s3.go

@@ -53,6 +53,7 @@ func newCASBackendUpdateAWSS3Cmd() *cobra.Command {
 					"region":          region,
 				},
 				Default:  isDefaultCASBackendUpdateOption,
+				Fallback: isFallbackCASBackendUpdateOption,
 				MaxBytes: parsedMaxBytes,
 			}
 

app/cli/documentation/cli-reference.mdx

@@ -640,6 +640,7 @@ Options
 ```
 --default              set the backend as default in your organization
 --description string   descriptive information for this registration
+--fallback             set the backend as fallback in your organization
 -h, --help                 help for add
 --max-bytes string     Maximum size for each blob stored in this backend (e.g., 100MB, 1GB)
 --name string          CAS backend name
@@ -691,6 +692,7 @@ Options inherited from parent commands
 --debug                     Enable debug/verbose logging mode
 --default                   set the backend as default in your organization
 --description string        descriptive information for this registration
+--fallback                  set the backend as fallback in your organization
 -i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
 --max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB)
 --name string               CAS backend name
@@ -731,6 +733,7 @@ Options inherited from parent commands
 --debug                     Enable debug/verbose logging mode
 --default                   set the backend as default in your organization
 --description string        descriptive information for this registration
+--fallback                  set the backend as fallback in your organization
 -i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
 --max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB)
 --name string               CAS backend name
@@ -770,6 +773,7 @@ Options inherited from parent commands
 --debug                     Enable debug/verbose logging mode
 --default                   set the backend as default in your organization
 --description string        descriptive information for this registration
+--fallback                  set the backend as fallback in your organization
 -i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
 --max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB)
 --name string               CAS backend name
@@ -807,6 +811,7 @@ Options inherited from parent commands
 --debug                     Enable debug/verbose logging mode
 --default                   set the backend as default in your organization
 --description string        descriptive information for this registration
+--fallback                  set the backend as fallback in your organization
 -i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
 --max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB)
 --name string               CAS backend name
@@ -915,13 +920,14 @@ Options inherited from parent commands
 
 ### chainloop cas-backend update
 
-Update a CAS backend description, credentials, default status, or max bytes
+Update a CAS backend description, credentials, default status, fallback status, or max bytes
 
 Options
 
 ```
 --default              set the backend as default in your organization
 --description string   descriptive information for this registration
+--fallback             set the backend as fallback in your organization
 -h, --help                 help for update
 --max-bytes string     Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.
 --name string          CAS backend name
@@ -972,6 +978,7 @@ Options inherited from parent commands
 --debug                     Enable debug/verbose logging mode
 --default                   set the backend as default in your organization
 --description string        descriptive information for this registration
+--fallback                  set the backend as fallback in your organization
 -i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
 --max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.
 -n, --org string                organization name
@@ -1009,6 +1016,7 @@ Options inherited from parent commands
 --debug                     Enable debug/verbose logging mode
 --default                   set the backend as default in your organization
 --description string        descriptive information for this registration
+--fallback                  set the backend as fallback in your organization
 -i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
 --max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.
 -n, --org string                organization name
@@ -1047,6 +1055,7 @@ Options inherited from parent commands
 --debug                     Enable debug/verbose logging mode
 --default                   set the backend as default in your organization
 --description string        descriptive information for this registration
+--fallback                  set the backend as fallback in your organization
 -i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
 --max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.
 --name string               CAS backend name
@@ -1058,7 +1067,7 @@ Options inherited from parent commands
 
 #### chainloop cas-backend update inline
 
-Update the Inline, fallback CAS Backend description or default status
+Update the Inline CAS Backend description, default status, or fallback status
 
 ```
 chainloop cas-backend update inline [flags]
@@ -1082,6 +1091,7 @@ Options inherited from parent commands
 --debug                     Enable debug/verbose logging mode
 --default                   set the backend as default in your organization
 --description string        descriptive information for this registration
+--fallback                  set the backend as fallback in your organization
 -i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
 --max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.
 -n, --org string                organization name
@@ -1118,6 +1128,7 @@ Options inherited from parent commands
 --debug                     Enable debug/verbose logging mode
 --default                   set the backend as default in your organization
 --description string        descriptive information for this registration
+--fallback                  set the backend as fallback in your organization
 -i, --insecure                  Skip TLS transport during connection to the control plane ($CHAINLOOP_API_INSECURE)
 --max-bytes string          Maximum size for each blob stored in this backend (e.g., 100MB, 1GB). Note: not supported for inline backends.
 -n, --org string                organization name

app/cli/pkg/action/casbackend_add.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2023 The Chainloop Authors.
+// Copyright 2023-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -33,6 +33,7 @@ type NewCASBackendAddOpts struct {
 	Provider    string
 	Description string
 	Default     bool
+	Fallback    bool
 	Credentials map[string]any
 	MaxBytes    *int64
 }
@@ -55,6 +56,7 @@ func (action *CASBackendAdd) Run(opts *NewCASBackendAddOpts) (*CASBackendItem, e
 		Provider:    opts.Provider,
 		Description: opts.Description,
 		Default:     opts.Default,
+		Fallback:    opts.Fallback,
 		Credentials: credentials,
 		MaxBytes:    opts.MaxBytes,
 	})

app/cli/pkg/action/casbackend_list.go

@@ -33,6 +33,7 @@ type CASBackendItem struct {
 	Description      string            `json:"description"`
 	Provider         string            `json:"provider"`
 	Default          bool              `json:"default"`
+	Fallback         bool              `json:"fallback"`
 	Inline           bool              `json:"inline"`
 	Limits           *CASBackendLimits `json:"limits"`
 	ValidationStatus ValidationStatus  `json:"validationStatus"`
@@ -85,6 +86,7 @@ func pbCASBackendItemToAction(in *pb.CASBackendItem) *CASBackendItem {
 		Description: in.Description,
 		Provider:    in.Provider,
 		Default:     in.Default,
+		Fallback:    in.Fallback,
 		CreatedAt:   toTimePtr(in.CreatedAt.AsTime()),
 		ValidatedAt: toTimePtr(in.ValidatedAt.AsTime()),
 		Inline:      in.IsInline,

app/cli/pkg/action/casbackend_update.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -31,6 +31,7 @@ type NewCASBackendUpdateOpts struct {
 	Name        string
 	Description *string
 	Default     *bool
+	Fallback    *bool
 	Credentials map[string]any
 	MaxBytes    *int64
 }
@@ -55,6 +56,7 @@ func (action *CASBackendUpdate) Run(opts *NewCASBackendUpdateOpts) (*CASBackendI
 		Name:        opts.Name,
 		Description: opts.Description,
 		Default:     opts.Default,
+		Fallback:    opts.Fallback,
 		Credentials: credentials,
 		MaxBytes:    opts.MaxBytes,
 	})