Add acceptance tests for custom CA certificate parameters

[st3penta]

The verify-enterprise-contract and verify-conforma-konflux-ta tasks support custom CA certificate configuration via CA_TRUST_CONFIGMAP_NAME and CA_TRUST_CONFIG_MAP_KEY parameters (introduced in PR #1814). These parameters allow mounting a ConfigMap containing a CA bundle so the CLI can communicate with registries and Rekor instances using non-standard CAs.

Currently, the only CA-related acceptance test covers the SSL_CERT_DIR parameter in task_validate_image.feature. There is no acceptance test coverage for:

1. CA_TRUST_CONFIGMAP_NAME / CA_TRUST_CONFIG_MAP_KEY parameters - verifying that a ConfigMap-provided CA bundle is correctly mounted and used during validation in the verify-enterprise-contract task.
2. verify-conforma-konflux-ta CA handling - the trusted artifacts variant has its own CA mount logic (mounting to /mnt/trusted-ca and conditionally exporting SSL_CERT_FILE), which has zero acceptance test coverage. This path has already required a production fix (PR fix(RELEASE-2397): custom ca support in verify-conforma task #3259 / RELEASE-2397).
3. End-to-end custom CA scenario - validating an image from a registry served with a self-signed certificate, using the custom CA parameters to provide the trust chain.

The lack of test coverage for these paths has contributed to regressions (e.g., RELEASE-2397 where the volume mount style caused failures when the ConfigMap was absent).

Acceptance criteria:

• Acceptance test exercises CA_TRUST_CONFIGMAP_NAME and CA_TRUST_CONFIG_MAP_KEY with a ConfigMap containing a custom CA bundle in the verify-enterprise-contract task
• Acceptance test exercises the trusted-ca mount and SSL_CERT_FILE logic in the verify-conforma-konflux-ta task
• Tests verify that the task succeeds when a valid CA bundle is provided and handles the case when the ConfigMap is absent gracefully

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 10:19 AM UTC · Completed 10:22 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-triage]

Triage Summary

This issue requests acceptance test coverage for custom CA certificate parameters across two Tekton tasks. The request is well-scoped and actionable.

Assessment

Current state: The only CA-related acceptance test covers SSL_CERT_DIR variable construction in task_validate_image.feature. No tests exercise CA_TRUST_CONFIGMAP_NAME/CA_TRUST_CONFIG_MAP_KEY parameters or the trusted artifacts variant's CA mount logic.

Infrastructure readiness: The test infrastructure is already in place — CreateConfigMap() in acceptance/kubernetes/kind/kubernetes.go supports creating ConfigMaps with custom content, and the Godog/Gherkin framework is well-established.

Recommended Test Scenarios

1. ConfigMap-based CA in verify-enterprise-contract — Create a trusted-ca ConfigMap, set CA_TRUST_CONFIGMAP_NAME/CA_TRUST_CONFIG_MAP_KEY, verify the bundle is mounted and used
2. Trusted-ca mount in verify-conforma-konflux-ta — Verify /mnt/trusted-ca mounting and SSL_CERT_FILE export logic
3. Absent ConfigMap graceful handling — Verify tasks don't crash when ConfigMap is missing (the regression scenario from RELEASE-2397)

# Conceptual test scenarios

Scenario: CA bundle from ConfigMap is used in verify-enterprise-contract
  Given a ConfigMap "trusted-ca" with key "ca-bundle.crt" containing a CA bundle
  When the verify-enterprise-contract task runs with CA_TRUST_CONFIGMAP_NAME and CA_TRUST_CONFIG_MAP_KEY
  Then the task succeeds with the CA bundle mounted

Scenario: verify-conforma-konflux-ta uses trusted-ca mount
  Given a ConfigMap with CA bundle data
  When the verify-conforma-konflux-ta task runs
  Then SSL_CERT_FILE is set to /mnt/trusted-ca/ca-bundle.crt

Scenario: Task handles absent ConfigMap gracefully
  When the task runs without a trusted-ca ConfigMap
  Then the task does not fail due to missing volume mount

Key files to modify:

• features/task_validate_image.feature — add ConfigMap CA scenario
• features/ta_task_validate_image.feature — add trusted-ca mount scenario
• Task definitions in tasks/verify-enterprise-contract/0.1/ and tasks/verify-conforma-konflux-ta/0.1/

---

Labels: Issue already has 'testing' label which is appropriate; adding 'enhancement' since this is a request for new test coverage.