The opensearch e2e suite reads HelmRelease history with its own copy of the jsonpath, so the upstream pin on that read does not cover it. In hack/e2e-chainsaw/opensearch/chainsaw-test.yaml:524-525 on main the step sources hack/e2e-chainsaw/_lib/remediation-guard.sh and then runs:
statuses=$(kubectl -n "$NAMESPACE" get helmrelease opensearch-test \
-o jsonpath='{range .status.history[*]}{.status}{"\n"}{end}')The library exports HELMRELEASE_HISTORY_JSONPATH for exactly this read, and internal/fluxcontract pins that variable against the upstream Flux type. docs/agents/e2e-testing.md section 6 says a copied literal is not covered by that pin. If Flux renames the field, this read goes empty without the Go test noticing. The suite's own "empty history on a Ready HR" check would still fail the run, so the impact is low.
Fix: use -o "jsonpath=${HELMRELEASE_HISTORY_JSONPATH}" here. It may also be worth letting the fluxcontract caller check see chainsaw suites, so the next copy is caught.
The opensearch e2e suite reads HelmRelease history with its own copy of the jsonpath, so the upstream pin on that read does not cover it. In
hack/e2e-chainsaw/opensearch/chainsaw-test.yaml:524-525on main the step sourceshack/e2e-chainsaw/_lib/remediation-guard.shand then runs:The library exports
HELMRELEASE_HISTORY_JSONPATHfor exactly this read, andinternal/fluxcontractpins that variable against the upstream Flux type.docs/agents/e2e-testing.mdsection 6 says a copied literal is not covered by that pin. If Flux renames the field, this read goes empty without the Go test noticing. The suite's own "empty history on a Ready HR" check would still fail the run, so the impact is low.Fix: use
-o "jsonpath=${HELMRELEASE_HISTORY_JSONPATH}"here. It may also be worth letting the fluxcontract caller check see chainsaw suites, so the next copy is caught.