feat: add v2 Executor CRD e2e test infrastructure

[fseldow]

Summary

Add end-to-end test infrastructure for the v2 Executor CRD (config.ratify.dev/v2alpha1) deployment path.

Changes

• test/bats/v2-base-test.bats — v2-named bats entrypoint that tracks test/bats/base-test.bats
• test/bats/base-test.bats — stabilized rollout waits and executor update coverage for the v2 provider tests
• Makefile — v2 aliases:
  • e2e-deploy-ratify-v2
  • e2e-build-ratify-v2-image
  • test-e2e-v2
• .github/workflows/e2e-k8s-v2.yml — manual v2 workflow entrypoint for the fork
• Makefile e2e-deploy-ratify — disables cert rotation for static e2e TLS certs so Gatekeeper keeps trusting the provider during mutation calls

Motivation

The v2 Gatekeeper provider path in deployments/ratify-gatekeeper-provider/ needs its own reliable e2e entrypoints and CI trigger path, plus stable in-cluster TLS behavior during mutation and rollout-heavy bats scenarios.

Testing

• python YAML parse of .github/workflows/e2e-k8s-v2.yml
• make -n test-e2e-v2 e2e-deploy-ratify-v2
• go test ./cmd/ratify-gatekeeper-provider ./internal/manager ./internal/verifier/... (hit a pre-existing failure in internal/verifier/keyprovider/filesystemprovider unrelated to these e2e changes)
• Triggered e2e-k8s-v2 on the fork branch after push

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds an end-to-end (e2e) “v2 executor” test suite and CI workflow to validate signed/unsigned image admission behavior under Gatekeeper + Ratify v2.

Changes:

• Introduces a new Bats test file covering v2 admission scenarios and executor scope behavior.
• Adds Makefile targets to deploy Ratify v2 and run the new v2 e2e tests.
• Adds a GitHub Actions workflow to bootstrap a kind cluster, deploy Gatekeeper/Ratify v2, run tests, and upload logs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
test/bats/v2-base-test.bats	Adds Bats-based v2 admission/e2e coverage (signed passes, unsigned rejected, scopes toggling).
Makefile	Adds v2 e2e test target plus build/deploy steps for Ratify v2 image and Helm install.
.github/workflows/e2e-k8s-v2.yml	Adds a CI workflow to run the new v2 e2e suite and upload logs.

Comments suppressed due to low confidence (1)

test/bats/v2-base-test.bats:1

• The shebang is not on the first line. This breaks direct execution of the file (e.g., ./v2-base-test.bats) because the kernel only honors a shebang on line 1. Move #!/usr/bin/env bats to line 1 and keep the copyright header as comments below it.

# Copyright The Ratify Authors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.60%. Comparing base (c6a515a) to head (2a20ecc).

Files with missing lines	Patch %	Lines
...al/verifier/keyprovider/inlineprovider/register.go	0.00%	4 Missing ⚠️

❌ Your patch check has failed because the patch coverage (66.66%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2565      +/-   ##
==========================================
- Coverage   77.62%   77.60%   -0.02%     
==========================================
  Files         105      105              
  Lines        4657     4667      +10     
==========================================
+ Hits         3615     3622       +7     
- Misses        893      896       +3     
  Partials      149      149              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.