fix(backups): carry dropdown option sources in CRD annotations, not schema - #2823

There are two critical issues with the current readiness check implementation:

1. Transient kubectl Failure Vulnerability: The loop condition while kubectl get hr -A --no-headers | grep -v " True " | grep -q .; do sleep 5; done will immediately terminate and succeed if kubectl fails transiently (e.g., due to rate limits or temporary API server unavailability). This is because a failure in kubectl results in empty output, which causes grep -q . to exit with 1 (false), ending the loop and letting the test pass silently.
2. False Positives from Status Messages: Grepping the entire line for " True " can lead to false positives if a non-ready HelmRelease has a status message or description containing the substring " True " (e.g., "reconciliation set to True" or "dependency True is not ready").

Solution

• Store the kubectl output in a variable and only evaluate readiness if the command succeeded.
• Use custom-columns to place the Ready condition status as the first column, and then use grep -v "^True" to precisely filter out ready releases, completely avoiding false matches in the namespace, name, or status message.

  if ! timeout 120 sh -ec '
    while true; do
      if out=$(kubectl get hr -A -o custom-columns=READY:.status.conditions[?(@.type=="Ready")].status,NS:.metadata.namespace,NAME:.metadata.name --no-headers 2>/dev/null); then
        if ! printf "%s\n" "$out" | grep -v "^True" | grep -q .; then
          exit 0
        fi
      fi
      sleep 5
    done
  '; then
    kubectl get hr -A
    # kubectl's STATUS column truncates long messages; dump the full Ready
    # condition per non-ready HR so the real error (e.g. a rejected CRD) is
    # visible in the test output instead of only inside the cozyreport.
    kubectl get hr -A -o custom-columns=READY:.status.conditions[?(@.type=="Ready")].status,NS:.metadata.namespace,NAME:.metadata.name --no-headers | grep -v "^True" | while read -r status ns name; do
      echo "--- Non-ready HelmRelease: $ns/$name (status: $status)" >&2
      kubectl get hr -n "$ns" "$name" -o jsonpath='{range .status.conditions[*]}{.type}={.status} reason={.reason}: {.message}{"\n"}{end}' >&2
    done

Both bots flagged the hole here and they're right, but their fixes keep the hand-rolled loop. No shell option can rescue this shape:

• a kubectl/API error → empty stdout → grep -q . exits 1 → the while condition is false → the loop ends and sh exits 0 → the gate passes green. The exact masking class this PR set out to fix.
• pipefail can't help even where available (sh is dash on the runners): kubectl's error exit is 1 and grep -q's no-match exit is 1 — indistinguishable. The verdict must not come out of a pipeline at all.
• grep " True " also substring-matches the free-text STATUS message, so a non-ready HR whose message contains True reads as ready.

Everywhere else in this file the readiness gate is kubectl wait ... --for=condition=ready (L153, L201, L277, …). The same idiom works here and makes every failure mode a non-zero exit: non-ready HR (named in the output), API error, even zero HRs matched (no matching resources found). Unknown flaps are absorbed natively — wait waits for the condition to become true within the window, which is what the 120s retry loop was hand-rolling.

Notes:

• awk '$4 != "True"' keys on the READY column positionally instead of substring-matching the whole line.
• the || trues live only in the failure path: bats aborts on any command error, so the diagnostics stay best-effort while the exit 1 verdict is unconditional.

Applied verbatim and amended into the e2e commit — the repo merges without squash, so I kept the history at two commits rather than stacking a fixup. Agreed the verdict must not come out of a pipeline: routing it through kubectl wait's own exit code makes a non-ready HR, an API error, and zero matches all non-zero — exactly the masking class this change set out to close. This also folds in the other readiness-check notes on the thread (substring match on the STATUS column, now awk '$4 != "True"' on READY).

With the gate below becoming a plain kubectl wait, this comment can shrink — the fan-out history lives in #2822.

Applied.