From 2ed4ece865bc34ec6241cf47ca376fbbcc0f8780 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Wed, 4 Mar 2026 17:11:46 +0100
Subject: [PATCH] build: reuse build session for policy source resolution

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 build/opt.go                |  2 +-
 tests/build.go              | 36 ++++++++++++++++++++++++++++++++++++
 util/sourcemeta/resolver.go | 18 +++++++++++++++++-
 3 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/build/opt.go b/build/opt.go
index 76beed681..d522c16b5 100644
--- a/build/opt.go
+++ b/build/opt.go
@@ -619,7 +619,7 @@ func configureSourcePolicy(ctx context.Context, np *noderesolver.ResolvedNode, o
 	if err != nil {
 		return nil, err
 	}
-	sourceResolver := sourcemeta.NewResolver(c, sourcemeta.WithProgressWriter(pw))
+	sourceResolver := sourcemeta.NewResolver(c, sourcemeta.WithProgressWriter(pw), sourcemeta.WithSession(so.Session))
 	defers = []func(error){
 		func(error) {
 			_ = sourceResolver.Close()
diff --git a/tests/build.go b/tests/build.go
index 327f7ddb5..562b7a599 100644
--- a/tests/build.go
+++ b/tests/build.go
@@ -48,6 +48,7 @@ var buildTests = []func(t *testing.T, sb integration.Sandbox){
 	testBuildAlias,
 	testBuildStdin,
 	testBuildRemote,
+	testBuildRemoteAuth,
 	testBuildLocalState,
 	testBuildLocalStateStdin,
 	testBuildLocalStateRemote,
@@ -267,6 +268,41 @@ COPY foo /foo
 	})
 }
 
+func testBuildRemoteAuth(t *testing.T, sb integration.Sandbox) {
+	dockerfile := []byte(`
+FROM busybox:latest
+COPY foo /foo
+`)
+	dir := tmpdir(
+		t,
+		fstest.CreateFile("Dockerfile", dockerfile, 0600),
+		fstest.CreateFile("foo", []byte("foo"), 0600),
+	)
+	dirDest := t.TempDir()
+
+	git, err := gitutil.New(gitutil.WithWorkingDir(dir))
+	require.NoError(t, err)
+
+	gittestutil.GitInit(git, t)
+	gittestutil.GitAdd(git, t, "Dockerfile", "foo")
+	gittestutil.GitCommit(git, t, "initial commit")
+
+	token := identity.NewID()
+	addr := gittestutil.GitServeHTTP(git, t, gittestutil.WithAccessToken(token))
+
+	out, err := buildCmd(sb, withDir(dir),
+		withEnv("GIT_AUTH_TOKEN="+token),
+		withArgs(
+			"--secret", "id=GIT_AUTH_TOKEN,env=GIT_AUTH_TOKEN",
+			"--output=type=local,dest="+dirDest,
+			addr,
+		),
+	)
+	require.NoError(t, err, out)
+
+	require.FileExists(t, filepath.Join(dirDest, "foo"))
+}
+
 func testBuildLocalState(t *testing.T, sb integration.Sandbox) {
 	dockerfile := []byte(`
 FROM busybox:latest AS base
diff --git a/util/sourcemeta/resolver.go b/util/sourcemeta/resolver.go
index c941db07f..8b959f75d 100644
--- a/util/sourcemeta/resolver.go
+++ b/util/sourcemeta/resolver.go
@@ -3,6 +3,7 @@ package sourcemeta
 import (
 	"context"
 	"errors"
+	"slices"
 	"sync"
 	"sync/atomic"
 
@@ -11,6 +12,7 @@ import (
 	"github.com/moby/buildkit/client/llb"
 	"github.com/moby/buildkit/client/llb/sourceresolver"
 	gwclient "github.com/moby/buildkit/frontend/gateway/client"
+	"github.com/moby/buildkit/session"
 	"github.com/moby/buildkit/solver/pb"
 )
 
@@ -44,6 +46,7 @@ type Option func(*newResolverOpts)
 
 type newResolverOpts struct {
 	progressWriter progress.Writer
+	session        []session.Attachable
 }
 
 func WithProgressWriter(pw progress.Writer) Option {
@@ -52,6 +55,12 @@ func WithProgressWriter(pw progress.Writer) Option {
 	}
 }
 
+func WithSession(session []session.Attachable) Option {
+	return func(o *newResolverOpts) {
+		o.session = slices.Clone(session)
+	}
+}
+
 func NewResolver(c *client.Client, opts ...Option) *Resolver {
 	var cfg newResolverOpts
 	for _, opt := range opts {
@@ -72,7 +81,14 @@ func NewResolver(c *client.Client, opts ...Option) *Resolver {
 			}()
 		}
 
-		_, err := c.Build(ctx, client.SolveOpt{Internal: true}, "buildx", func(ctx context.Context, gw gwclient.Client) (*gwclient.Result, error) {
+		solveOpt := client.SolveOpt{
+			Internal: true,
+		}
+		if len(cfg.session) > 0 {
+			solveOpt.Session = cfg.session
+		}
+
+		_, err := c.Build(ctx, solveOpt, "buildx", func(ctx context.Context, gw gwclient.Client) (*gwclient.Result, error) {
 			ready <- gw
 			<-ctx.Done()
 			return nil, context.Cause(ctx)