The fork e2e lane can test images built on one base of main with chainsaw tests from a later one, and fail deterministically on a change the PR never touched.
The Pull Request workflow builds the PR images from refs/pull/<n>/merge as it is at build time. e2e-fork.yaml then checks out refs/pull/<n>/merge again when the e2e job starts (Checkout PR merge ref). The assert after it only compares HEAD^2 with the resolved PR head, so a move of the merge ref's base parent (HEAD^1) between the two goes through. If main gains a change to a first-party component and its test in that window, the job runs the new test against the old image.
Seen on #4831 and #4167 (runs 38081016193 attempts 1 and 2, 38082220541): the images were built on bases without #4638, the e2e checkout already had it, and tenant-gateway-passthrough-reservation failed the same way every time. The controller wrote Accepted=True while the post-#4638 test expects NoMatchingListenerHostname. A rerun reuses the same artifacts, so it fails again; only a fresh build fixes it.
Fix shape: pin the e2e checkout to the merge commit the build used (pass its SHA through the build artifacts and check out that commit, or assert HEAD^1 as well as HEAD^2), so tests and images always come from the same tree.
The fork e2e lane can test images built on one base of main with chainsaw tests from a later one, and fail deterministically on a change the PR never touched.
The
Pull Requestworkflow builds the PR images fromrefs/pull/<n>/mergeas it is at build time.e2e-fork.yamlthen checks outrefs/pull/<n>/mergeagain when the e2e job starts (Checkout PR merge ref). The assert after it only comparesHEAD^2with the resolved PR head, so a move of the merge ref's base parent (HEAD^1) between the two goes through. If main gains a change to a first-party component and its test in that window, the job runs the new test against the old image.Seen on #4831 and #4167 (runs 38081016193 attempts 1 and 2, 38082220541): the images were built on bases without #4638, the e2e checkout already had it, and
tenant-gateway-passthrough-reservationfailed the same way every time. The controller wroteAccepted=Truewhile the post-#4638 test expectsNoMatchingListenerHostname. A rerun reuses the same artifacts, so it fails again; only a fresh build fixes it.Fix shape: pin the e2e checkout to the merge commit the build used (pass its SHA through the build artifacts and check out that commit, or assert
HEAD^1as well asHEAD^2), so tests and images always come from the same tree.