alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

policy: implement policy support for bake

Browse Source 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This commit is contained in:
Tonis Tiigi
2026-01-14 09:34:23 -08:00
parent 6f9a1cfb17
commit 9f1daffb32
13 changed files with 605 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build/build.go
+3 -11
View File
@@ -97,15 +97,7 @@ type Options struct {
SourcePolicy *spb.Policy
GroupRef string
Annotations map[exptypes.AnnotationKey]string // Not used during build, annotations are already set in Exports. Just used to check for support with drivers.
Policy []PolicyConfig
}
type PolicyConfig struct {
Files []policy.File
Reset bool
Disabled bool
Strict *bool
LogLevel *logrus.Level
Policy []buildflags.PolicyConfig
}
type CallFunc struct {
@@ -135,7 +127,7 @@ type policyOpt struct {
LogLevel *logrus.Level
}
func withPolicyConfig(defaultPolicy policyOpt, configs []PolicyConfig) ([]policyOpt, error) {
func withPolicyConfig(defaultPolicy policyOpt, configs []buildflags.PolicyConfig) ([]policyOpt, error) {
if len(configs) == 0 {
if len(defaultPolicy.Files) == 0 {
return nil, nil
@@ -161,7 +153,7 @@ func withPolicyConfig(defaultPolicy policyOpt, configs []PolicyConfig) ([]policy
out = append(out, defaultPolicy)
}
var last PolicyConfig
var last buildflags.PolicyConfig
for _, cfg := range configs {
if cfg.Reset {
build/policy_test.go
+11 -10
View File
@@ -5,6 +5,7 @@ import (
"testing"
"github.com/docker/buildx/policy"
"github.com/docker/buildx/util/buildflags"
"github.com/sirupsen/logrus"
"github.com/stretchr/testify/require"
)
@@ -39,33 +40,33 @@ func TestWithPolicyConfigDefaults(t *testing.T) {
// TestWithPolicyConfigDisabled validates disabled policy behavior across invalid and valid combinations.
func TestWithPolicyConfigDisabled(t *testing.T) {
_, err := withPolicyConfig(policyOpt{}, []PolicyConfig{
_, err := withPolicyConfig(policyOpt{}, []buildflags.PolicyConfig{
{Disabled: true, Files: []policy.File{{Filename: "x.rego"}}},
})
require.Error(t, err)
_, err = withPolicyConfig(policyOpt{}, []PolicyConfig{
_, err = withPolicyConfig(policyOpt{}, []buildflags.PolicyConfig{
{Disabled: true, Reset: true},
})
require.Error(t, err)
_, err = withPolicyConfig(policyOpt{}, []PolicyConfig{
_, err = withPolicyConfig(policyOpt{}, []buildflags.PolicyConfig{
{Disabled: true, Strict: boolPtr(true)},
})
require.Error(t, err)
_, err = withPolicyConfig(policyOpt{}, []PolicyConfig{
_, err = withPolicyConfig(policyOpt{}, []buildflags.PolicyConfig{
{Disabled: true, LogLevel: levelPtr(logrus.WarnLevel)},
})
require.Error(t, err)
_, err = withPolicyConfig(policyOpt{}, []PolicyConfig{
_, err = withPolicyConfig(policyOpt{}, []buildflags.PolicyConfig{
{Disabled: true},
{},
})
require.Error(t, err)
out, err := withPolicyConfig(policyOpt{}, []PolicyConfig{
out, err := withPolicyConfig(policyOpt{}, []buildflags.PolicyConfig{
{Disabled: true},
})
require.NoError(t, err)
@@ -81,7 +82,7 @@ func TestWithPolicyConfigResetAndFiles(t *testing.T) {
},
}
out, err := withPolicyConfig(defaultPolicy, []PolicyConfig{
out, err := withPolicyConfig(defaultPolicy, []buildflags.PolicyConfig{
{Reset: true},
{Files: []policy.File{{Filename: "a.rego"}}},
})
@@ -97,7 +98,7 @@ func TestWithPolicyConfigStrictAndLogLevel(t *testing.T) {
Files: []policy.File{{Filename: "default.rego"}},
}
out, err := withPolicyConfig(defaultPolicy, []PolicyConfig{
out, err := withPolicyConfig(defaultPolicy, []buildflags.PolicyConfig{
{Strict: boolPtr(true), LogLevel: levelPtr(logrus.WarnLevel)},
})
require.NoError(t, err)
@@ -109,7 +110,7 @@ func TestWithPolicyConfigStrictAndLogLevel(t *testing.T) {
// TestWithPolicyConfigStrictIgnoredWithoutPolicy ensures strict without any policy produces no entries.
func TestWithPolicyConfigStrictIgnoredWithoutPolicy(t *testing.T) {
out, err := withPolicyConfig(policyOpt{}, []PolicyConfig{
out, err := withPolicyConfig(policyOpt{}, []buildflags.PolicyConfig{
{Strict: boolPtr(true)},
})
require.NoError(t, err)
@@ -125,7 +126,7 @@ func TestWithPolicyConfigMultipleFilesAndOverrides(t *testing.T) {
},
}
out, err := withPolicyConfig(defaultPolicy, []PolicyConfig{
out, err := withPolicyConfig(defaultPolicy, []buildflags.PolicyConfig{
{Files: []policy.File{{Filename: "a.rego"}}},
{Strict: boolPtr(true), LogLevel: levelPtr(logrus.WarnLevel)},
{Files: []policy.File{{Filename: "b.rego"}}, Strict: boolPtr(true)},