Preflight #345

	---
	name: Preflight
	'on':
	schedule:
	- cron: '0 0 * * *'
	# pull_request:
	# branches: [ main ]
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	preflight-latest:
	runs-on: ubuntu-22.04
	env:
	SHELL: /bin/bash
	IMAGE_NAME: quay.io/redhat-best-practices-for-k8s/oct:latest

	steps:
	- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

	- name: Set up Go 1.23
	uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
	with:
	go-version: 1.23.2

	- name: Disable default go problem matcher
	run: echo "::remove-matcher owner=go::"

	- name: Clone the preflight repository
	uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
	with:
	repository: redhat-openshift-ecosystem/openshift-preflight
	path: openshift-preflight

	- name: Run preflight
	working-directory: openshift-preflight
	run: \|
	make build
	./preflight check container ${{ env.IMAGE_NAME }} --artifacts ${GITHUB_WORKSPACE}/openshift-preflight/artifacts

	ALLOWED_FAILURES=("HasLicense" "RunAsNonRoot" "HasUniqueTag")
	FAILURES=$(cat ${GITHUB_WORKSPACE}/openshift-preflight/artifacts/amd64/results.json \| jq -r '.results.failed[].name')

	for FAILURE in $FAILURES; do
	FAILURE=$(echo $FAILURE \| tr -d '"')
	if [[ ! "${ALLOWED_FAILURES[@]}" =~ "${FAILURE}" ]]; then
	echo >&2 "ERROR: $FAILURE is not an allowed failure"
	exit 1
	fi
	done

Provide feedback