test(e2e): add Executor v2alpha1 bats fixtures & group v1 fixtures into v1/

[fseldow]

Summary

Two fixture-tree changes:

1. Add Executor v2alpha1 fixtures. New config.ratify.dev/v2alpha1 Executor manifests used by the upcoming v2 provider bats e2e suite.
2. Relocate v1 fixtures. Move the pre-existing config_v1beta1_*.yaml files into test/bats/tests/config/v1/ so the v1 and v2 trees are visually separate. Because the v1 fixtures now live under their own v1/ subdir, the new files do not need a v2_ prefix.

Important — references not updated yet

This PR is fixture-tree only. It does NOT touch base-test.bats, azure-test.bats, helpers.bash, the Makefile, or any workflow. The Gatekeeper constraint / constraint-template YAML is also intentionally kept out and will land separately.

Because the v1 fixture paths change, the existing references in base-test.bats / azure-test.bats (≈27 paths) become stale until the follow-up PR — which rewrites the suite to apply v2 Executor CRs — lands. This PR is meant to land together with that follow-up, not on its own.

Fixtures added (file → consuming @test)

File	Consuming test
executor_cosign_keyless.yaml	cosign keyless test
executor_cosign_legacy.yaml	cosign legacy keyed test
executor_cosign_legacy_keyless.yaml	cosign legacy keyless test
executor_invalid_store.yaml	store crd status check
executor_k8s_secret_auth.yaml	validate K8s secrets ORAS auth provider
executor_namespace_cosign.yaml	namespaced notation/cosign verifiers test
executor_namespace_notation.yaml	namespaced notation/cosign verifiers test
executor_no_notation.yaml	validate crd add, replace and delete + namespaced notation/cosign verifiers test
executor_no_verifiers.yaml	namespaced notation/cosign verifiers test
executor_notation_akv.yaml	Azure KeyVault notation flow (consumed by follow-up azure-test.bats rewrite)
executor_cosign_akv.yaml	Azure KeyVault cosign flow (consumed by follow-up azure-test.bats rewrite)

The two AKV fixtures use __VAULT_URI__ / __CLIENT_ID__ / __TENANT_ID__ / __NOTATION_CERT_NAME__ / __COSIGN_KEY_NAME__ placeholders, to be substituted via sed at runtime (same pattern the current v1 azure tests use against the config/samples/clustered/kmp/* templates).

v1 fixtures moved

All 10 config_v1beta1_*.yaml files → test/bats/tests/config/v1/.

Related

Split out of #2565.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds Gatekeeper/Ratify BATS test fixtures for config.ratify.dev/v2alpha1 Executor and Gatekeeper constraints/templates to cover namespace-scoped keys and several negative/edge configurations.

Changes:

• Added multiple v2 Executor YAML configs to exercise store/verifier/policy combinations (including invalid store and keyless cases).
• Added Gatekeeper ConstraintTemplate variants (default vs namespace-prefixed key format) plus a Constraint for test deployments.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
test/bats/tests/config/v2_executor_no_verifiers.yaml	New v2 Executor fixture intended to represent “no verifiers” behavior via a non-matching verifier scope.
test/bats/tests/config/v2_executor_no_notation.yaml	New v2 Executor fixture for cosign-only verification (no notation verifier).
test/bats/tests/config/v2_executor_namespace_notation.yaml	New v2 Executor fixture scoped to a namespace/repo path for notation verification.
test/bats/tests/config/v2_executor_namespace_cosign.yaml	New v2 Executor fixture scoped to a namespace/repo path for cosign verification.
test/bats/tests/config/v2_executor_k8s_secret_auth.yaml	New v2 Executor fixture for credentialed registry access (currently static creds).
test/bats/tests/config/v2_executor_invalid_store.yaml	New v2 Executor fixture with an invalid store type for negative-path testing.
test/bats/tests/config/v2_executor_cosign_legacy_keyless.yaml	New v2 Executor fixture for cosign keyless trust policy (legacy-labeled).
test/bats/tests/config/v2_executor_cosign_legacy.yaml	New v2 Executor fixture for cosign (key-based) + notation together (legacy-labeled).
test/bats/tests/config/v2_executor_cosign_keyless.yaml	New v2 Executor fixture for cosign keyless trust policy.
test/bats/tests/config/constraint_template_default.yaml	New Gatekeeper ConstraintTemplate using non-namespaced image keys for Ratify external_data calls.
test/bats/tests/config/constraint_template.yaml	New Gatekeeper ConstraintTemplate using namespace-prefixed image keys for Ratify external_data calls.
test/bats/tests/config/constraint.yaml	New Gatekeeper Constraint applying the template to Pods in selected namespaces.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.62%. Comparing base (5eb83f5) to head (46dea08).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2583   +/-   ##
=======================================
  Coverage   77.62%   77.62%           
=======================================
  Files         105      105           
  Lines        4657     4657           
=======================================
  Hits         3615     3615           
  Misses        893      893           
  Partials      149      149           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[YitongFeng-git]

the moved fixtures are referenced from test/bats/base-test.bats (13 sites) and test/bats/azure-test.bats (6 sites) — all of the form ./test/bats/tests/config/config_v1beta1_*.yaml, which now need /v1/ inserted. Note: don't touch the ./config/samples/...config_v1beta1_*.yaml references; those files didn't move.

[charleswool]

Would moving the v1 fixtures into v1/ breaks the existing references still pointing at the old paths?

[fseldow]

Would moving the v1 fixtures into v1/ breaks the existing references still pointing at the old paths?

may consider to modify in future pr. CUrrently reference is e2e test, e2e is not working

[YitongFeng-git]

lgtm