build: resolve policy files from context state and unified FS

Support remote context policy files via resolved context state and cwd:// override.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

build/policy_test.go

@@ -1,7 +1,6 @@
 package build
 
 import (
-	"io/fs"
 	"testing"
 
 	"github.com/docker/buildx/policy"
@@ -21,11 +20,8 @@ func levelPtr(v logrus.Level) *logrus.Level {
 // TestWithPolicyConfigDefaults ensures default policy is returned when no configs are provided.
 func TestWithPolicyConfigDefaults(t *testing.T) {
 	defaultPolicy := policyOpt{
-		Files: []policy.File{
-			{Filename: "default.rego", Data: []byte("package policy")},
-		},
-		FS: func() (fs.StatFS, func() error, error) {
-			return nil, nil, nil
+		Files: []policyFileSpec{
+			{Filename: "default.rego", Optional: true},
 		},
 	}
 
@@ -35,7 +31,6 @@ func TestWithPolicyConfigDefaults(t *testing.T) {
 	require.Equal(t, defaultPolicy.Files, out[0].Files)
 	require.False(t, out[0].Strict)
 	require.Nil(t, out[0].LogLevel)
-	require.NotNil(t, out[0].FS)
 }
 
 // TestWithPolicyConfigDisabled validates disabled policy behavior across invalid and valid combinations.
@@ -76,10 +71,7 @@ func TestWithPolicyConfigDisabled(t *testing.T) {
 // TestWithPolicyConfigResetAndFiles ensures reset drops defaults and uses explicitly provided files.
 func TestWithPolicyConfigResetAndFiles(t *testing.T) {
 	defaultPolicy := policyOpt{
-		Files: []policy.File{{Filename: "default.rego"}},
-		FS: func() (fs.StatFS, func() error, error) {
-			return nil, nil, nil
-		},
+		Files: []policyFileSpec{{Filename: "default.rego", Optional: true}},
 	}
 
 	out, err := withPolicyConfig(defaultPolicy, []buildflags.PolicyConfig{
@@ -89,13 +81,13 @@ func TestWithPolicyConfigResetAndFiles(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, out, 1)
 	require.Equal(t, "a.rego", out[0].Files[0].Filename)
-	require.NotNil(t, out[0].FS)
+	require.False(t, out[0].Files[0].Optional)
 }
 
 // TestWithPolicyConfigStrictAndLogLevel ensures strict and log level apply to existing policy.
 func TestWithPolicyConfigStrictAndLogLevel(t *testing.T) {
 	defaultPolicy := policyOpt{
-		Files: []policy.File{{Filename: "default.rego"}},
+		Files: []policyFileSpec{{Filename: "default.rego", Optional: true}},
 	}
 
 	out, err := withPolicyConfig(defaultPolicy, []buildflags.PolicyConfig{
@@ -120,10 +112,7 @@ func TestWithPolicyConfigStrictIgnoredWithoutPolicy(t *testing.T) {
 // TestWithPolicyConfigMultipleFilesAndOverrides ensures per-entry overrides and carryover apply across multiple files.
 func TestWithPolicyConfigMultipleFilesAndOverrides(t *testing.T) {
 	defaultPolicy := policyOpt{
-		Files: []policy.File{{Filename: "default.rego"}},
-		FS: func() (fs.StatFS, func() error, error) {
-			return nil, nil, nil
-		},
+		Files: []policyFileSpec{{Filename: "default.rego", Optional: true}},
 	}
 
 	out, err := withPolicyConfig(defaultPolicy, []buildflags.PolicyConfig{
@@ -134,12 +123,13 @@ func TestWithPolicyConfigMultipleFilesAndOverrides(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, out, 3)
 	require.Equal(t, "default.rego", out[0].Files[0].Filename)
+	require.True(t, out[0].Files[0].Optional)
 	require.Equal(t, "a.rego", out[1].Files[0].Filename)
+	require.False(t, out[1].Files[0].Optional)
 	require.True(t, out[1].Strict)
 	require.NotNil(t, out[1].LogLevel)
 	require.Equal(t, logrus.WarnLevel, *out[1].LogLevel)
 	require.Equal(t, "b.rego", out[2].Files[0].Filename)
+	require.False(t, out[2].Files[0].Optional)
 	require.True(t, out[2].Strict)
-	require.NotNil(t, out[1].FS)
-	require.NotNil(t, out[2].FS)
 }