ci: kubeconform, pluto weekly, nightly E2E

- kubeconform: validate CRD manifests against k8s 1.29-1.31 on every push
- pluto-weekly: deprecated API detection, Monday 04:00 UTC
- nightly-e2e: Kind cluster smoke test, 02:00 UTC, diagnostics artifact on failure

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: syscod3

.github/workflows/kubeconform.yml

@@ -0,0 +1,28 @@
+name: Kubeconform
+
+on: [push, pull_request, workflow_dispatch]
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        k8s: ["1.29", "1.30", "1.31"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install kubeconform
+        run: |
+          curl -sSfL https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz \
+            | tar -xz -C /usr/local/bin
+
+      - name: Install kustomize
+        run: |
+          curl -sSfL https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.3.0/kustomize_v5.3.0_linux_amd64.tar.gz \
+            | tar -xz -C /usr/local/bin
+
+      - name: Validate manifests
+        run: |
+          kustomize build config/default \
+            | kubeconform -strict -ignore-missing-schemas \
+              -kubernetes-version ${{ matrix.k8s }}.0

.github/workflows/nightly-e2e.yml

@@ -0,0 +1,53 @@
+name: Nightly E2E
+
+on:
+  schedule:
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: nightly-e2e
+  cancel-in-progress: false
+
+jobs:
+  e2e:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+
+      - uses: helm/kind-action@v1
+
+      - name: Build and load image
+        run: |
+          make docker-build IMG=controller:test
+          kind load docker-image controller:test
+
+      - name: Run E2E
+        run: make test-e2e
+        continue-on-error: true
+        id: e2e
+
+      - name: Collect diagnostics
+        if: steps.e2e.outcome == 'failure'
+        run: |
+          mkdir -p /tmp/diagnostics
+          kubectl get nodes -o wide > /tmp/diagnostics/nodes.txt
+          kubectl get pods -A > /tmp/diagnostics/pods.txt
+          kubectl get events -A --sort-by='.lastTimestamp' > /tmp/diagnostics/events.txt
+          kubectl logs -n oci-pivot-system -l control-plane=controller-manager > /tmp/diagnostics/controller.log || true
+
+      - name: Upload diagnostics
+        if: steps.e2e.outcome == 'failure'
+        uses: actions/upload-artifact@v4
+        with:
+          name: e2e-diagnostics
+          path: /tmp/diagnostics/
+
+      - name: Fail if E2E failed
+        if: steps.e2e.outcome == 'failure'
+        run: exit 1

.github/workflows/pluto-weekly.yml

@@ -0,0 +1,23 @@
+name: Pluto — Deprecated API Detection
+
+on:
+  schedule:
+    - cron: "0 4 * * 1"   # Monday 04:00 UTC
+  workflow_dispatch:
+
+jobs:
+  pluto:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        k8s: ["v1.29.0", "v1.30.0", "v1.31.0"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install pluto
+        run: |
+          curl -sSfL https://github.com/FairwindsOps/pluto/releases/download/v5.23.5/pluto_5.23.5_linux_amd64.tar.gz \
+            | tar -xz -C /usr/local/bin
+
+      - name: Detect deprecated APIs
+        run: pluto detect-files -d config/ --target-versions k8s=${{ matrix.k8s }}