apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  annotations:
    pod-policies.kyverno.io/autogen-controllers: none
  name: check-slsa-attestations-pass-4
spec:
  background: false
  rules:
  - match:
      any:
      - resources:
          kinds:
          - Pod
    name: check-builder-id-keyless
    verifyImages:
    - attestations:
      - conditions:
        - all:
          - key: '{{ regex_match(''^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/heads/main'',''{{
              builder.id}}'') }}'
            operator: Equals
            value: true
        predicateType: https://slsa.dev/provenance/v0.2
      imageReferences:
      - ghcr.io/chipzoller/zulu*
  validationFailureAction: enforce
