Summary
The source-to-suite mapping in hack/select-e2e.sh (the case around lines 245-251 on current main) only maps sources whose name ends in -application, plus a hardcoded external-dns. Two suites stand on sources that match neither: kuberture (cozystack.kuberture) and securitygroup (cozystack.securitygroup-controller). The dependency-graph walk reaches both of them (each declares dependsOn: cozystack.networking), but the final filter discards them because their source name is not *-application.
Why it matters
packages/core/platform/sources/networking.yaml owns system/cilium, so an edit to packages/system/cilium/values.yaml selects 19 of the 21 suites, everything except kuberture and securitygroup. Those two are exactly the controllers that depend on the CNI being changed, so a CNI change does not run the suites most likely to regress from it. Symmetrically, an edit to packages/system/kuberture/* maps to no suite, falls through to the empty-selection safety net, and burns the full run instead of its own suite. The old wc -w > 5 full-suite assertions in select-e2e_test.bats hid this, since 19 is still greater than 5; converting them to exact-set equality surfaces it as the one failing case of 27, with the other 26 staying green.
Fix shape
Either add kuberture and securitygroup-controller next to the existing external-dns exception, or generalize the filter to map any source whose derived suite name exists in the known suite set (all_apps) rather than gating on the -application suffix. The general form is preferable: it also covers future non-application suites instead of accumulating hardcoded names.
Summary
The source-to-suite mapping in
hack/select-e2e.sh(thecasearound lines 245-251 on current main) only maps sources whose name ends in-application, plus a hardcodedexternal-dns. Two suites stand on sources that match neither:kuberture(cozystack.kuberture) andsecuritygroup(cozystack.securitygroup-controller). The dependency-graph walk reaches both of them (each declaresdependsOn: cozystack.networking), but the final filter discards them because their source name is not*-application.Why it matters
packages/core/platform/sources/networking.yamlownssystem/cilium, so an edit topackages/system/cilium/values.yamlselects 19 of the 21 suites, everything exceptkubertureandsecuritygroup. Those two are exactly the controllers that depend on the CNI being changed, so a CNI change does not run the suites most likely to regress from it. Symmetrically, an edit topackages/system/kuberture/*maps to no suite, falls through to the empty-selection safety net, and burns the full run instead of its own suite. The oldwc -w > 5full-suite assertions inselect-e2e_test.batshid this, since 19 is still greater than 5; converting them to exact-set equality surfaces it as the one failing case of 27, with the other 26 staying green.Fix shape
Either add
kubertureandsecuritygroup-controllernext to the existingexternal-dnsexception, or generalize the filter to map any source whose derived suite name exists in the known suite set (all_apps) rather than gating on the-applicationsuffix. The general form is preferable: it also covers future non-application suites instead of accumulating hardcoded names.