hack/select-e2e.sh escalates a change under packages/system/<pkg> to the full suite by way of a safety net at the end of the script: a system source with no *-application descendants leaves final_apps empty, and an empty selection falls back to every suite.
# Safety net: a system source with no *-application descendants would otherwise
# silently skip E2E. Fall back to full suite so a path inside the graph is
# never silently dropped.
if [ -z "$final_apps" ]; then
echo "$all_apps" | paste -sd ' ' -
exit 0
fi
The fallback keys off emptiness alone, so anything else that contributes a suite name swallows the signal. Editing one unrelated suite's tests is enough:
$ printf 'packages/system/cozystack-basics/templates/ingress-hostname-policy.yaml\n' > /tmp/a
$ sh hack/select-e2e.sh /tmp/a
bucket clickhouse etcd external-dns foundationdb gateway harbor kafka kubernetes-latest
kubernetes-oidc-customconfig kubernetes-oidc-system kubernetes-previous kuberture mariadb
mongodb openbao postgres qdrant redis securitygroup serviceexposure vminstance
$ printf 'packages/system/cozystack-basics/templates/ingress-hostname-policy.yaml\nhack/e2e-chainsaw/postgres/chainsaw-test.yaml\n' > /tmp/b
$ sh hack/select-e2e.sh /tmp/b
postgres
The same system-package change that selects 22 suites on its own selects exactly one once the PR also touches an unrelated suite. The narrowing is silent — nothing in the output records that an escalation was dropped.
The shape that triggers it is ordinary: change a platform component, and add or adjust e2e nearby. packages/core/, api/, cmd/, internal/, hack/*.sh and the Makefile match full_suite_pattern and escalate unconditionally, so they are unaffected; packages/system/ is the one that depends on the empty-selection fallback and can therefore lose it.
A fix would track the escalation as its own flag — set when a source cannot be mapped to any *-application descendant — and union it with the selected suites, rather than inferring it from an empty list.
Found while working on #3208, which is itself an instance: it edits packages/system/cozystack-basics and hack/e2e-chainsaw/gateway, and so runs gateway where the package change alone would have run everything. Harmless there — the change is a semantic no-op on the all-lowercase configuration every e2e cluster uses, and gateway is where the touched policies' e2e lives — but the mechanism is general.
hack/select-e2e.shescalates a change underpackages/system/<pkg>to the full suite by way of a safety net at the end of the script: a system source with no*-applicationdescendants leavesfinal_appsempty, and an empty selection falls back to every suite.The fallback keys off emptiness alone, so anything else that contributes a suite name swallows the signal. Editing one unrelated suite's tests is enough:
The same system-package change that selects 22 suites on its own selects exactly one once the PR also touches an unrelated suite. The narrowing is silent — nothing in the output records that an escalation was dropped.
The shape that triggers it is ordinary: change a platform component, and add or adjust e2e nearby.
packages/core/,api/,cmd/,internal/,hack/*.shand theMakefilematchfull_suite_patternand escalate unconditionally, so they are unaffected;packages/system/is the one that depends on the empty-selection fallback and can therefore lose it.A fix would track the escalation as its own flag — set when a source cannot be mapped to any
*-applicationdescendant — and union it with the selected suites, rather than inferring it from an empty list.Found while working on #3208, which is itself an instance: it edits
packages/system/cozystack-basicsandhack/e2e-chainsaw/gateway, and so runsgatewaywhere the package change alone would have run everything. Harmless there — the change is a semantic no-op on the all-lowercase configuration every e2e cluster uses, andgatewayis where the touched policies' e2e lives — but the mechanism is general.