fix(e2e): improve failure diagnostics - #3421

No actionable comments were generated in the recent review. 🎉

sequenceDiagram
  participant kubectl
  participant pod_filter_affected
  participant dataplane_capture
  participant LoadBalancer_checks
  kubectl->>pod_filter_affected: provide pod status rows
  pod_filter_affected->>dataplane_capture: return scheduled NotReady pods
  dataplane_capture->>LoadBalancer_checks: continue when no affected pods

sequenceDiagram
  participant cozyreport.sh
  participant cozyreport_collect_talos_node
  participant talosctl
  cozyreport.sh->>cozyreport_collect_talos_node: pass config, node, and output directory
  cozyreport_collect_talos_node->>talosctl: collect dmesg and service logs
  talosctl-->>cozyreport_collect_talos_node: write diagnostic output

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Verdict

LGTM with non-blocking notes

Diagnostics/CI-only change (no packages/ touched); the three new behavior tests are non-vacuous and pass under the CI dash path, the shell is portable, and the pre-commit worktree fix is behavior-preserving. Two minor items could not be verified offline and are noted below.

Caveats

• Phase 5b/5c (upgrade + fresh-install / config-matrix): not applicable. The PR touches only hack/* diagnostics + hack/e2e-chainsaw/* test manifests + .pre-commit-config.yaml; no chart, values.yaml, migration, CRD, RBAC, PackageSource, bundle, or ApplicationDefinition. No customer upgrade or install surface is affected.

• Shell portability (dash vs ash vs bash): verified, no defect. hack/cozyreport.sh and hack/e2e-capture-dataplane.sh are #!/bin/sh, contain no bashisms (grep for set -o pipefail/[[/arrays/local/<<</${x,,} returned only comment-text false hits), pass dash -n, and both new bats suites run green when driven through hack/cozytest.sh under /bin/sh=dash (the CI runner path). The sourcing guards (return 0 2>/dev/null in cozyreport.sh:16-18 of the diff; E2E_CAPTURE_DATAPLANE_LIB guard at hack/e2e-capture-dataplane.sh:219) behave correctly: the guard variable is a non-exported shell var, so the subprocess-invoked full-script test (capture-dataplane.bats:66-84) is not short-circuited by it.

• cozytest.sh hook fidelity: verified, no dead code. Neither new .bats file defines setup/teardown/setup_file/teardown_file (those are silently never run by hack/cozytest.sh). The top-level talosctl() mock in hack/cozyreport-talos.bats:14-16 is correctly placed at file scope, not nested in the @test, matching the runner's bare-} block-terminator constraint documented in its comment (hack/cozyreport-talos.bats:12-13); the test passes, confirming the mock is in scope at call time.

• Test adequacy (Phase 5d): required regression tests present and non-vacuous, verified by mutation. Reverting pod_filter_affected to require a podIP ($3!="") turns capture-dataplane.bats:45 RED; reverting cozyreport_collect_talos_node to the old -n-only + dmesg --tail=200 shape turns cozyreport-talos.bats:18 RED; re-adding the pre-fix early exit 0 on empty affected turns the LB-independence test capture-dataplane.bats:66 RED. All three mutations produced the expected failure; the fixes are protected.

• hack/e2e-chainsaw/{bucket,harbor}/chainsaw-test.yaml format: yaml on the get collector: not offline-schema-validated (no chainsaw binary in the hermetic environment). Low risk: .chainsaw.yaml:195 already uses format: XML, so format is a known field in this tree, and the PR body's chainsaw test --no-cluster --include-test-regex '^$' run exercises manifest parsing. An operator running the chainsaw suite on a dev cluster confirms it live.

• .pre-commit-config.yaml worktree lock fix (sh -c 'exec flock -x "$(git rev-parse --git-common-dir)/pre-commit.lock" "$@"' -- sh -c '...'): traced the argv wrapping — "$@" resolves to sh -c '<inner>' <appended-files>, so flock acquires the shared lock then execs the inner generator; appended filenames land as ignored positionals exactly as in the pre-change form. Behavior-preserving except for the intended common-dir path. Confirmed git rev-parse --git-common-dir returns .git in a normal checkout (identical to the old literal). No automated regression test accompanies this (inherent to a pre-commit entry); manual trace only.