test(e2e): run the cacert suite when the writer policy changes

select-e2e.sh mapped reverse dependencies to Chainsaw suites only through
*-application sources and a hardcoded external-dns, so a change confined to the
tenant-projection writer policy (shipped by cozystack-basics) selected every
suite that depends on it but not cacert — whose Chainsaw is the policy's only
live deny/allow proof. Add the cozystack-basics reverse mapping, mirroring the
external-dns precedent, and pin both directions: a cozystack-basics change
selects cacert, and a cacert run installs cozystack-basics.

Signed-off-by: Aleksei Sviridkin <f@lex.la>

hack/select-e2e.sh

@@ -157,6 +157,10 @@ for s in $all_sources; do
   case "$app" in
     *-application) final="$final $(src_to_suites "$app")" ;;
     external-dns) final="$final external-dns" ;;
+    # cozystack-basics ships the tenant-projection writer policy, whose only live
+    # deny/allow proof is the cacert suite. A change confined to that policy must
+    # run it — the *-application filter would otherwise drop cozystack-basics.
+    cozystack-basics) final="$final cacert" ;;
   esac
 done
 

hack/select-e2e_test.bats

@@ -170,3 +170,16 @@
     output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources") || true
     [ -z "$output" ]
 }
+
+@test "tenant-projection writer policy change selects the cacert suite" {
+    # The cacert suite is the writer policy's only live deny/allow proof. A change
+    # confined to cozystack-basics (which ships that policy) must run it and must
+    # not escalate to the full suite.
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    echo "packages/system/cozystack-basics/templates/tenant-projection-writer-policy.yaml" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    echo "$output" | grep -wq cacert
+    [ "$(echo "$output" | wc -w)" -le 5 ]
+}

hack/select-install_test.bats

@@ -46,6 +46,15 @@
     echo "$output" | grep -wq cozystack.kubernetes-application
 }
 
+@test "cacert suite maps back to the cozystack-basics source" {
+    # The reverse companion (select-e2e.sh) selects cacert for a cozystack-basics
+    # change; this pins the forward side, so that run actually installs the package
+    # shipping the tenant-projection writer policy the suite proves.
+    output=$(hack/select-install.sh "cacert")
+    echo "$output" | grep -wq cozystack.cozystack-basics
+    echo "$output" | grep -wq cozystack.cozystack-engine
+}
+
 @test "multiple suites union their closures" {
     output=$(hack/select-install.sh "postgres kafka")
     echo "$output" | grep -wq cozystack.postgres-application