How to check manifests only labels

[Minivolk02]

Question

Hi, I have two clusterimagepolicies

apiVersion: policy.sigstore.dev/v1alpha1
kind: ClusterImagePolicy
metadata:
name: image-policy-objectmeta
spec:
mode: warn
match:
- resource: deployments
version: v1
group: apps
selector:
matchLabels:
group: back
images:

• glob: "nginx"
  authorities:
  • static:
    action: fail

---

apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
name: image-policy-default
spec:
images:

• glob: "**"
  authorities:
  • static:
    action: pass

And one deployment:
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
spec:
selector:
matchLabels:
app: nginx
replicas: 1
template:
metadata:
labels:
app: nginx
group: back
spec:
containers:
- name: nginx
image: nginx:1.14.2
ports:
- containerPort: 80

I want to check image only if manifest have label : group: back , and others manifests should not fail, how get it?
Now it doesnt work i dont know why please help me