policy: add docker_github_builder_tag builtin helper

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2026-01-16 11:48:55 -08:00
parent 1d19f3e2dd
commit 86885cd8a2
3 changed files with 76 additions and 19 deletions
@@ -0,0 +1,23 @@
+package docker
+
+docker_github_builder(image, repo) if {
+	image.hasProvenance
+	some sig in image.signatures
+	docker_github_builder_signature(sig, repo)
+}
+
+docker_github_builder_tag(image, repo, tag) if {
+	docker_github_builder(image, repo)
+	some sig in image.signatures
+	sig.signer.sourceRepositoryRef == sprintf("refs/tags/%s", [tag])
+}
+
+docker_github_builder_signature(sig, repo) if {
+	sig.kind == "docker-github-builder"
+	sig.type == "bundle-v0.3"
+	sig.signer.certificateIssuer == "CN=sigstore-intermediate,O=sigstore.dev"
+	sig.signer.issuer == "https://token.actions.githubusercontent.com"
+	sig.signer.sourceRepositoryURI == sprintf("https://github.com/%s", [repo])
+	sig.signer.runnerEnvironment == "github-hosted"
+	count(sig.timestamps) > 0
+}