From 6bf2390c54e1556b2e356033308fa54dfd5da72f Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 21 Jul 2026 13:55:07 +0300
Subject: [PATCH] test(e2e): run the cacert suite when the writer policy
 changes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

select-e2e.sh mapped reverse dependencies to Chainsaw suites only through
*-application sources and a hardcoded external-dns, so a change confined to the
tenant-projection writer policy (shipped by cozystack-basics) selected every
suite that depends on it but not cacert — whose Chainsaw is the policy's only
live deny/allow proof. Add the cozystack-basics reverse mapping, mirroring the
external-dns precedent, and pin both directions: a cozystack-basics change
selects cacert, and a cacert run installs cozystack-basics.

Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 hack/select-e2e.sh            |  4 ++++
 hack/select-e2e_test.bats     | 13 +++++++++++++
 hack/select-install_test.bats |  9 +++++++++
 3 files changed, 26 insertions(+)

diff --git a/hack/select-e2e.sh b/hack/select-e2e.sh
index 14e7bb923..3747ba9c2 100755
--- a/hack/select-e2e.sh
+++ b/hack/select-e2e.sh
@@ -157,6 +157,10 @@ for s in $all_sources; do
   case "$app" in
     *-application) final="$final $(src_to_suites "$app")" ;;
     external-dns) final="$final external-dns" ;;
+    # cozystack-basics ships the tenant-projection writer policy, whose only live
+    # deny/allow proof is the cacert suite. A change confined to that policy must
+    # run it — the *-application filter would otherwise drop cozystack-basics.
+    cozystack-basics) final="$final cacert" ;;
   esac
 done
 
diff --git a/hack/select-e2e_test.bats b/hack/select-e2e_test.bats
index 323012714..20a060a65 100644
--- a/hack/select-e2e_test.bats
+++ b/hack/select-e2e_test.bats
@@ -170,3 +170,16 @@
     output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources") || true
     [ -z "$output" ]
 }
+
+@test "tenant-projection writer policy change selects the cacert suite" {
+    # The cacert suite is the writer policy's only live deny/allow proof. A change
+    # confined to cozystack-basics (which ships that policy) must run it and must
+    # not escalate to the full suite.
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    echo "packages/system/cozystack-basics/templates/tenant-projection-writer-policy.yaml" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    echo "$output" | grep -wq cacert
+    [ "$(echo "$output" | wc -w)" -le 5 ]
+}
diff --git a/hack/select-install_test.bats b/hack/select-install_test.bats
index 82d685238..b5469a03a 100644
--- a/hack/select-install_test.bats
+++ b/hack/select-install_test.bats
@@ -46,6 +46,15 @@
     echo "$output" | grep -wq cozystack.kubernetes-application
 }
 
+@test "cacert suite maps back to the cozystack-basics source" {
+    # The reverse companion (select-e2e.sh) selects cacert for a cozystack-basics
+    # change; this pins the forward side, so that run actually installs the package
+    # shipping the tenant-projection writer policy the suite proves.
+    output=$(hack/select-install.sh "cacert")
+    echo "$output" | grep -wq cozystack.cozystack-basics
+    echo "$output" | grep -wq cozystack.cozystack-engine
+}
+
 @test "multiple suites union their closures" {
     output=$(hack/select-install.sh "postgres kafka")
     echo "$output" | grep -wq cozystack.postgres-application