From ae86c584b446ee9571f325ead66016cd5da7a580 Mon Sep 17 00:00:00 2001
From: Tonis Tiigi <tonistiigi@gmail.com>
Date: Sun, 11 Jan 2026 23:05:46 -0800
Subject: [PATCH] tests: add policy flag integration test

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
---
 tests/integration_test.go |  1 +
 tests/policy_build.go     | 75 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 76 insertions(+)
 create mode 100644 tests/policy_build.go

diff --git a/tests/integration_test.go b/tests/integration_test.go
index a0efa9b61..b19d6f573 100644
--- a/tests/integration_test.go
+++ b/tests/integration_test.go
@@ -23,6 +23,7 @@ func TestIntegration(t *testing.T) {
 	var tests []func(t *testing.T, sb integration.Sandbox)
 	tests = append(tests, commonTests...)
 	tests = append(tests, buildTests...)
+	tests = append(tests, policyBuildTests...)
 	tests = append(tests, bakeTests...)
 	tests = append(tests, historyTests...)
 	tests = append(tests, inspectTests...)
diff --git a/tests/policy_build.go b/tests/policy_build.go
new file mode 100644
index 000000000..d484472a1
--- /dev/null
+++ b/tests/policy_build.go
@@ -0,0 +1,75 @@
+package tests
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/containerd/continuity/fs/fstest"
+	"github.com/moby/buildkit/util/testutil/integration"
+	"github.com/stretchr/testify/require"
+)
+
+var policyBuildTests = []func(t *testing.T, sb integration.Sandbox){
+	testBuildPolicyAllow,
+	testBuildPolicyDeny,
+}
+
+func testBuildPolicyAllow(t *testing.T, sb integration.Sandbox) {
+	dockerfile := []byte(`
+FROM busybox:latest
+RUN echo policy-ok
+`)
+	policyFile := []byte(`
+package docker
+
+default decision = {"allow": true}
+`)
+	dir := tmpdir(
+		t,
+		fstest.CreateFile("Dockerfile", dockerfile, 0600),
+		fstest.CreateFile("policy.rego", policyFile, 0600),
+	)
+	policyPath := filepath.Join(dir, "policy.rego")
+
+	cmd := buildxCmd(sb, withDir(dir), withArgs(
+		"build",
+		"--progress=plain",
+		"--policy", "filename="+policyPath,
+		"--output=type=cacheonly",
+		dir,
+	))
+	out, err := cmd.CombinedOutput()
+	require.NoError(t, err, string(out))
+	require.Contains(t, string(out), "loading policies "+policyPath)
+}
+
+func testBuildPolicyDeny(t *testing.T, sb integration.Sandbox) {
+	dockerfile := []byte(`
+FROM busybox:latest
+RUN echo policy-nope
+`)
+	policyFile := []byte(`
+package docker
+
+default decision = {"allow": false, "deny_msg": ["denied by test"]}
+`)
+	dir := tmpdir(
+		t,
+		fstest.CreateFile("Dockerfile", dockerfile, 0600),
+		fstest.CreateFile("policy.rego", policyFile, 0600),
+	)
+	policyPath := filepath.Join(dir, "policy.rego")
+
+	cmd := buildxCmd(sb, withDir(dir), withArgs(
+		"build",
+		"--progress=plain",
+		"--policy", "filename="+policyPath,
+		"--output=type=cacheonly",
+		dir,
+	))
+	out, err := cmd.CombinedOutput()
+	require.Error(t, err, string(out))
+	require.Contains(t, string(out), "loading policies "+policyPath)
+	require.Contains(t, string(out), "policy decision for source")
+	require.Contains(t, string(out), "DENY")
+}