feat: expose Prometheus metrics and instrument requests

[charleswool]

Description

The pkg/metrics package (OpenTelemetry + Prometheus, ported from v1) was never wired into the gatekeeper provider: InitMetricsExporter was never called and no request duration was ever recorded, so the provider emitted no metrics and served no /metrics endpoint.

Change

• Initialize the Prometheus exporter on startup, behind a new --enable-metrics flag (default false) plus --metrics-port (default 8888), matching the v1 flag convention. Exporter init failures are logged but non-fatal (metrics must not take down verification).
• Instrument the handlers: record ratify_verification_request / ratify_mutation_request durations in verify / mutate.
• initMetricsFunc is a package var so tests stay hermetic (no port bind / global mux registration).

Follow-ups (separate PRs):

• feat: expose provider metrics in the Helm chart #2848 — expose the metrics port + scrape annotations in the Helm chart.
• feat: add per-request trace IDs and system-error metrics #2849 — per-request trace IDs and system-error metrics.

Testing

• Unit tests updated for the new flags, including a case asserting metrics-init failure is non-fatal (asserted via errors.Is that startRatify does not return the metrics-init error).
• verify/mutate instrumentation covered by existing handler tests.
• go build ./..., go vet, package tests, and golangci-lint pass.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.63%. Comparing base (fc48792) to head (cff0036).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2847   +/-   ##
=======================================
  Coverage   76.63%   76.63%           
=======================================
  Files          89       89           
  Lines        4104     4104           
=======================================
  Hits         3145     3145           
  Misses        812      812           
  Partials      147      147           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR wires the existing pkg/metrics (OpenTelemetry + Prometheus) into the Gatekeeper provider so it actually exposes a /metrics endpoint and emits request-duration metrics for the verify/mutate paths.

Changes:

• Add request-duration instrumentation in internal/httpserver verify/mutate handlers.
• Add --metrics-port flag and initialize the Prometheus exporter during provider startup (non-fatal on init failure).
• Update Gatekeeper provider unit tests for the new flag and metrics init behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
internal/httpserver/handlers.go	Adds timing + reporting for verification and mutation request durations.
cmd/ratify-gatekeeper-provider/main.go	Introduces --metrics-port and initializes the Prometheus exporter during startup.
cmd/ratify-gatekeeper-provider/main_test.go	Updates parsing and startup tests for the new metrics flag/init path.

Comments suppressed due to low confidence (1)

cmd/ratify-gatekeeper-provider/main_test.go:123

• This test mutates global function variables (startManagerFunc, initMetricsFunc) without restoring them, which can make the test suite order-dependent. Also, returning a freshly-allocated errors.New(...) each call makes it harder to assert that the metrics init error is not returned by startRatify.

	startManagerFunc = func(_ chan struct{}, _, _ bool) {}
	initMetricsFunc = func(string, int) error { return errors.New("metrics boom") }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[charleswool]

Closing — this is now an empty PR.

#2848 was stacked on this branch and carried commit deaa305 with it, so when #2848 was squash-merged as 6782e78 the metrics wiring landed on main along with the chart change. GitHub now reports 0 changed files here.

Everything from this PR is on main:

• cmd/ratify-gatekeeper-provider/main.go — the --enable-metrics / --metrics-port flags and the initMetricsFunc("prometheus", ...) call
• internal/httpserver/handlers.go — ReportVerificationRequest / ReportMutationRequest instrumentation in verify / mutate

The follow-ups #2849 and #2873 no longer need to be stacked on this branch; I'll rebase them straight onto main.