alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

policy: add docker_github_builder_tag builtin helper

Browse Source 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This commit is contained in:
Tonis Tiigi
2026-01-16 11:48:55 -08:00
parent 1d19f3e2dd
commit 86885cd8a2
3 changed files with 76 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/policy_test.go
+46
View File
@@ -247,6 +247,50 @@ test_docker_github_builder_denied if {
}
not result.allow
}
test_docker_github_builder_tag if {
docker_github_builder_tag({
"hasProvenance": true,
"signatures": [{
"kind": "docker-github-builder",
"type": "bundle-v0.3",
"signer": {
"certificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev",
"issuer": "https://token.actions.githubusercontent.com",
"sourceRepositoryURI": "https://github.com/org/repo",
"sourceRepositoryRef": "refs/tags/v1.2.3",
"runnerEnvironment": "github-hosted"
},
"timestamps": [{
"type": "tlog",
"uri": "https://example.com/tlog",
"timestamp": "2024-01-01T00:00:00Z"
}]
}]
}, "org/repo", "v1.2.3")
}
test_docker_github_builder_tag_denied if {
not docker_github_builder_tag({
"hasProvenance": true,
"signatures": [{
"kind": "docker-github-builder",
"type": "bundle-v0.3",
"signer": {
"certificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev",
"issuer": "https://token.actions.githubusercontent.com",
"sourceRepositoryURI": "https://github.com/org/repo",
"sourceRepositoryRef": "refs/tags/other",
"runnerEnvironment": "github-hosted"
},
"timestamps": [{
"type": "tlog",
"uri": "https://example.com/tlog",
"timestamp": "2024-01-01T00:00:00Z"
}]
}]
}, "org/repo", "v1.2.3")
}
`), 0600),
)
@@ -261,4 +305,6 @@ test_docker_github_builder_denied if {
require.NoError(t, err, string(out))
require.Contains(t, string(out), "test_docker_github_builder: PASS")
require.Contains(t, string(out), "test_docker_github_builder_denied: PASS")
require.Contains(t, string(out), "test_docker_github_builder_tag: PASS")
require.Contains(t, string(out), "test_docker_github_builder_tag_denied: PASS")
}