fix: correct CEL evaluation for strict seccomp inheritance

[harinandhreddy0411]

Related Issue(s)

Closes #1446

Description

This PR fixes the CEL evaluation logic for strict seccomp inheritance. It addresses the behavior mismatch reported when transforming the restrict-seccomp-strict ClusterPolicy into CEL-Expressions.

Checklist

• I have read the policy contribution guidelines.
• I have added test manifests and resources covering both positive and negative tests that prove this policy works as intended.
• I have added the artifacthub-pkg.yml file and have verified it is complete and correct.

[Suhani95]

@harinandhreddy0411 Thanks for the PR. Could you please complete the PR template, including the Related Issue, Description, and testing details? Having that context will help with the review.

[harinandhreddy0411]

@harinandhreddy0411 Thanks for the PR. Could you please complete the PR template, including the Related Issue, Description, and testing details? Having that context will help with the review.

Thanks for the heads-up! I just updated the PR description with the related issue (#1446), the description, and the checklist.

[harinandhreddy0411]

/assign

[Copilot]

Pull request overview

This pull request fixes the CEL validation logic for the restrict-seccomp-strict (Restricted) Pod Security Standards policy so that container-level seccomp settings are evaluated correctly when inheriting from the Pod-level spec.securityContext.seccompProfile.type.

Changes:

• Updates the CEL expressions to require each (init/ephemeral/regular) container to either set an allowed seccompProfile.type (RuntimeDefault/Localhost) or inherit an allowed value from the Pod securityContext.
• Updates validation messages to reflect the “explicitly set or inherited” behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Suhani95]

@harinandhreddy0411 Thanks for the PR! It looks like some checks are currently failing. I'll take a closer look once they're green.

[harinandhreddy0411]

Hi @realshuting, I've pushed the fixes for the artifacthub digest and the CEL expression syntax. It looks like the workflows are currently awaiting approval to run the CI tests. Could you please trigger the workflow approval when you have a moment?

[harinandhreddy0411]

Hi @Suhani95, just wanted to ping you on this since you were the one who originally caught the failing checks! I have updated the artifacthub-pkg.yml digest and fixed the CEL expression syntax.

I tagged Shuting earlier to approve the workflow run, but I know the core team is swamped with the release. If you have a few minutes to review the new changes (or if you have the permissions to trigger the CI workflows so they can turn green), I would really appreciate it!

[harinandhreddy0411]

Done! @Suhani95 I have added the regression test cases for both the inherited and completely unset scenarios in the test resources.