From 86885cd8a2ac1bf2d0a3a57127d0fe800fceb706 Mon Sep 17 00:00:00 2001
From: Tonis Tiigi <tonistiigi@gmail.com>
Date: Thu, 15 Jan 2026 21:29:48 -0800
Subject: [PATCH] policy: add docker_github_builder_tag builtin helper

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
---
 policy/builtin_module.go | 26 ++++++-----------------
 policy/builtins.rego     | 23 ++++++++++++++++++++
 tests/policy_test.go     | 46 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 76 insertions(+), 19 deletions(-)
 create mode 100644 policy/builtins.rego

diff --git a/policy/builtin_module.go b/policy/builtin_module.go
index c04364c53..03513d053 100644
--- a/policy/builtin_module.go
+++ b/policy/builtin_module.go
@@ -1,27 +1,15 @@
 package policy
 
-import "github.com/open-policy-agent/opa/v1/ast"
+import (
+	_ "embed"
+
+	"github.com/open-policy-agent/opa/v1/ast"
+)
 
 const builtinPolicyModuleFilename = "builtin/buildx_defaults.rego"
 
-const builtinPolicyModule = `package docker
-
-docker_github_builder(image, repo) if {
-	image.hasProvenance
-	some sig in image.signatures
-	valid_docker_github_builder_signature(sig, repo)
-}
-
-valid_docker_github_builder_signature(sig, repo) if {
-	sig.kind == "docker-github-builder"
-	sig.type == "bundle-v0.3"
-	sig.signer.certificateIssuer == "CN=sigstore-intermediate,O=sigstore.dev"
-	sig.signer.issuer == "https://token.actions.githubusercontent.com"
-	sig.signer.sourceRepositoryURI == sprintf("https://github.com/%s", [repo])
-	sig.signer.runnerEnvironment == "github-hosted"
-	count(sig.timestamps) > 0
-}
-`
+//go:embed builtins.rego
+var builtinPolicyModule string
 
 func builtinPolicyModuleAST() (*ast.Module, error) {
 	return ast.ParseModuleWithOpts(builtinPolicyModuleFilename, builtinPolicyModule, ast.ParserOptions{
diff --git a/policy/builtins.rego b/policy/builtins.rego
new file mode 100644
index 000000000..62462d061
--- /dev/null
+++ b/policy/builtins.rego
@@ -0,0 +1,23 @@
+package docker
+
+docker_github_builder(image, repo) if {
+	image.hasProvenance
+	some sig in image.signatures
+	docker_github_builder_signature(sig, repo)
+}
+
+docker_github_builder_tag(image, repo, tag) if {
+	docker_github_builder(image, repo)
+	some sig in image.signatures
+	sig.signer.sourceRepositoryRef == sprintf("refs/tags/%s", [tag])
+}
+
+docker_github_builder_signature(sig, repo) if {
+	sig.kind == "docker-github-builder"
+	sig.type == "bundle-v0.3"
+	sig.signer.certificateIssuer == "CN=sigstore-intermediate,O=sigstore.dev"
+	sig.signer.issuer == "https://token.actions.githubusercontent.com"
+	sig.signer.sourceRepositoryURI == sprintf("https://github.com/%s", [repo])
+	sig.signer.runnerEnvironment == "github-hosted"
+	count(sig.timestamps) > 0
+}
diff --git a/tests/policy_test.go b/tests/policy_test.go
index 4374d57ec..7f51696c9 100644
--- a/tests/policy_test.go
+++ b/tests/policy_test.go
@@ -247,6 +247,50 @@ test_docker_github_builder_denied if {
 	}
 	not result.allow
 }
+
+test_docker_github_builder_tag if {
+	docker_github_builder_tag({
+		"hasProvenance": true,
+		"signatures": [{
+			"kind": "docker-github-builder",
+			"type": "bundle-v0.3",
+			"signer": {
+				"certificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev",
+				"issuer": "https://token.actions.githubusercontent.com",
+				"sourceRepositoryURI": "https://github.com/org/repo",
+				"sourceRepositoryRef": "refs/tags/v1.2.3",
+				"runnerEnvironment": "github-hosted"
+			},
+			"timestamps": [{
+				"type": "tlog",
+				"uri": "https://example.com/tlog",
+				"timestamp": "2024-01-01T00:00:00Z"
+			}]
+		}]
+	}, "org/repo", "v1.2.3")
+}
+
+test_docker_github_builder_tag_denied if {
+	not docker_github_builder_tag({
+		"hasProvenance": true,
+		"signatures": [{
+			"kind": "docker-github-builder",
+			"type": "bundle-v0.3",
+			"signer": {
+				"certificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev",
+				"issuer": "https://token.actions.githubusercontent.com",
+				"sourceRepositoryURI": "https://github.com/org/repo",
+				"sourceRepositoryRef": "refs/tags/other",
+				"runnerEnvironment": "github-hosted"
+			},
+			"timestamps": [{
+				"type": "tlog",
+				"uri": "https://example.com/tlog",
+				"timestamp": "2024-01-01T00:00:00Z"
+			}]
+		}]
+	}, "org/repo", "v1.2.3")
+}
 `), 0600),
 	)
 
@@ -261,4 +305,6 @@ test_docker_github_builder_denied if {
 	require.NoError(t, err, string(out))
 	require.Contains(t, string(out), "test_docker_github_builder: PASS")
 	require.Contains(t, string(out), "test_docker_github_builder_denied: PASS")
+	require.Contains(t, string(out), "test_docker_github_builder_tag: PASS")
+	require.Contains(t, string(out), "test_docker_github_builder_tag_denied: PASS")
 }