fix policy files

Author: st3penta

.github/workflows/pull_request.yml

@@ -113,8 +113,7 @@ jobs:
         with:
           args: >
             validate image
-            --policy "policy/policy.yaml"
-            --rule-data "policy/rule_data_pull_request.yaml"
+            --policy "policy/policy_pull_request.yaml"
             --image "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-and-attest.outputs.digest }}"
             --certificate-identity-regexp "^https://github\.com/${{ github.repository_owner }}/${{ github.event.repository.name }}/"
             --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

.github/workflows/release.yml

@@ -114,8 +114,7 @@ jobs:
         with:
           args: >
             validate image
-            --policy "policy/policy.yaml"
-            --rule-data "policy/rule_data_release.yaml"
+            --policy "policy/policy_release.yaml"
             --image "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-and-attest.outputs.digest }}"
             --certificate-identity-regexp "^https://github\.com/${{ github.repository_owner }}/${{ github.event.repository.name }}/"
             --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

policy/policy.yaml

@@ -0,0 +1,12 @@
+sources:
+  - policy:
+      - ./policy/rules
+      - ./policy/lib
+
+    ruleData:
+      disallowed_packages:
+        - purl: "pkg:golang/github.com/rs/zerolog"
+          format: "semver"
+          max: "1.31.0"
+      allowed_builder_ids:
+        - https://github.com/st3penta/fosdem-2026-build-sample/.github/workflows/pr-build.yml@refs/pull/

policy/policy_pull_request.yaml

@@ -0,0 +1,12 @@
+sources:
+  - policy:
+      - ./policy/rules
+      - ./policy/lib
+
+    ruleData:
+      disallowed_packages:
+        - purl: "pkg:golang/github.com/rs/zerolog"
+          format: "semver"
+          max: "1.31.0"
+      allowed_builder_ids:
+        - https://github.com/st3penta/fosdem-2026-build-sample/.github/workflows/build-attest.yml@refs/heads/main