policy: add docker_github_builder_tag builtin helper

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

policy/builtin_module.go

@@ -1,27 +1,15 @@
 package policy
 
-import "github.com/open-policy-agent/opa/v1/ast"
+import (
+	_ "embed"
+
+	"github.com/open-policy-agent/opa/v1/ast"
+)
 
 const builtinPolicyModuleFilename = "builtin/buildx_defaults.rego"
 
-const builtinPolicyModule = `package docker
+//go:embed builtins.rego
-
+var builtinPolicyModule string
-docker_github_builder(image, repo) if {
-	image.hasProvenance
-	some sig in image.signatures
-	valid_docker_github_builder_signature(sig, repo)
-}
-
-valid_docker_github_builder_signature(sig, repo) if {
-	sig.kind == "docker-github-builder"
-	sig.type == "bundle-v0.3"
-	sig.signer.certificateIssuer == "CN=sigstore-intermediate,O=sigstore.dev"
-	sig.signer.issuer == "https://token.actions.githubusercontent.com"
-	sig.signer.sourceRepositoryURI == sprintf("https://github.com/%s", [repo])
-	sig.signer.runnerEnvironment == "github-hosted"
-	count(sig.timestamps) > 0
-}
-`
 
 func builtinPolicyModuleAST() (*ast.Module, error) {
 	return ast.ParseModuleWithOpts(builtinPolicyModuleFilename, builtinPolicyModule, ast.ParserOptions{

policy/builtins.rego

@@ -0,0 +1,23 @@
+package docker
+
+docker_github_builder(image, repo) if {
+	image.hasProvenance
+	some sig in image.signatures
+	docker_github_builder_signature(sig, repo)
+}
+
+docker_github_builder_tag(image, repo, tag) if {
+	docker_github_builder(image, repo)
+	some sig in image.signatures
+	sig.signer.sourceRepositoryRef == sprintf("refs/tags/%s", [tag])
+}
+
+docker_github_builder_signature(sig, repo) if {
+	sig.kind == "docker-github-builder"
+	sig.type == "bundle-v0.3"
+	sig.signer.certificateIssuer == "CN=sigstore-intermediate,O=sigstore.dev"
+	sig.signer.issuer == "https://token.actions.githubusercontent.com"
+	sig.signer.sourceRepositoryURI == sprintf("https://github.com/%s", [repo])
+	sig.signer.runnerEnvironment == "github-hosted"
+	count(sig.timestamps) > 0
+}

tests/policy_test.go

@@ -247,6 +247,50 @@ test_docker_github_builder_denied if {
 	}
 	not result.allow
 }
+
+test_docker_github_builder_tag if {
+	docker_github_builder_tag({
+		"hasProvenance": true,
+		"signatures": [{
+			"kind": "docker-github-builder",
+			"type": "bundle-v0.3",
+			"signer": {
+				"certificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev",
+				"issuer": "https://token.actions.githubusercontent.com",
+				"sourceRepositoryURI": "https://github.com/org/repo",
+				"sourceRepositoryRef": "refs/tags/v1.2.3",
+				"runnerEnvironment": "github-hosted"
+			},
+			"timestamps": [{
+				"type": "tlog",
+				"uri": "https://example.com/tlog",
+				"timestamp": "2024-01-01T00:00:00Z"
+			}]
+		}]
+	}, "org/repo", "v1.2.3")
+}
+
+test_docker_github_builder_tag_denied if {
+	not docker_github_builder_tag({
+		"hasProvenance": true,
+		"signatures": [{
+			"kind": "docker-github-builder",
+			"type": "bundle-v0.3",
+			"signer": {
+				"certificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev",
+				"issuer": "https://token.actions.githubusercontent.com",
+				"sourceRepositoryURI": "https://github.com/org/repo",
+				"sourceRepositoryRef": "refs/tags/other",
+				"runnerEnvironment": "github-hosted"
+			},
+			"timestamps": [{
+				"type": "tlog",
+				"uri": "https://example.com/tlog",
+				"timestamp": "2024-01-01T00:00:00Z"
+			}]
+		}]
+	}, "org/repo", "v1.2.3")
+}
 `), 0600),
 	)
 
@@ -261,4 +305,6 @@ test_docker_github_builder_denied if {
 	require.NoError(t, err, string(out))
 	require.Contains(t, string(out), "test_docker_github_builder: PASS")
 	require.Contains(t, string(out), "test_docker_github_builder_denied: PASS")
+	require.Contains(t, string(out), "test_docker_github_builder_tag: PASS")
+	require.Contains(t, string(out), "test_docker_github_builder_tag_denied: PASS")
 }