Function testPolicyTestNestedPath

tests/policy_test.go:140–185

(t *testing.T, sb integration.Sandbox)

}

func testPolicyTestNestedPath(t *testing.T, sb integration.Sandbox) {
	skipNoCompatBuildKit(t, sb, ">= 0.26.0-0", "policy input requires BuildKit v0.26.0+")
	dir := tmpdir(
		t,
		fstest.CreateFile("Dockerfile.rego", []byte(`
package docker

default allow = false

allow if input.image.repo == "example/allowlist"

decision := {"allow": allow}
`), 0600),
		fstest.CreateDir("scripts", 0700),
		fstest.CreateFile("scripts/policy_test.rego", []byte(`
package docker

test_allowlisted_repo if {
	result := data.docker.decision with input as {"image": {"repo": "example/allowlist"}}
	result.allow
}
`), 0600),
	)

	cmd := buildxCmd(sb, withDir(dir), withArgs(
		"policy",
		"test",
		"--filename",
		"Dockerfile",
		"scripts/policy_test.rego",
	))
	out, err := cmd.CombinedOutput()
	require.NoError(t, err, string(out))
	require.Contains(t, string(out), "test_allowlisted_repo: PASS")

	cmd = buildxCmd(sb, withDir(dir), withArgs(
		"policy",
		"test",
		"--filename",
		"Dockerfile",
		"scripts",
	))
	out, err = cmd.CombinedOutput()
	require.NoError(t, err, string(out))
	require.Contains(t, string(out), "test_allowlisted_repo: PASS")
}

func testPolicyTestDockerGitHubBuilder(t *testing.T, sb integration.Sandbox) {
	skipNoCompatBuildKit(t, sb, ">= 0.26.0-0", "policy input requires BuildKit v0.26.0+")