[e2e-scan] Test: Improve e2e coverage for control-plane group apply UPDATE (expand scenario)

[github-actions]

Gap Summary

The control-plane/groups scenario only exercises the CREATE → verify →
dump → plan-idempotent → delete path for control plane groups. It never
tests an apply-mode UPDATE that changes group members or fields after
initial creation. The only group member update test in the control-plane
slice is via sync mode in control-plane/sync-groups.

This matters because apply-mode and sync-mode handle group member changes
differently:

• Sync mode deletes the removed member, creates the new member, and updates
  the group — all three changes
• Apply mode creates the new member and updates the group but does NOT
  delete the old member (apply only acts on declared resources)
• A regression in apply-mode group member reference resolution or group
  UPDATE planning would go undetected

An unused overlay at groups/overlays/002-update-members/ suggests this
coverage was planned but never wired into the scenario.

Evidence

• test/e2e/scenarios/control-plane/groups/scenario.yaml — 5 steps (reset,
  apply-create, verify-type, verify-members-dump, plan-idempotent, delete);
  no step uses inputOverlayDirs
• test/e2e/scenarios/control-plane/groups/overlays/002-update-members/control-plane.yaml
  — exists but is never referenced by the scenario; comments out
  groups-staging-runtime and adds groups-emea-runtime with updated group
  member references
• test/e2e/scenarios/control-plane/sync-groups/scenario.yaml — step
  002-update-group-members exercises the equivalent member swap via sync,
  which produces 3 changes (DELETE staging, CREATE emea, UPDATE group)
• internal/declarative/resources/control_plane.go — group member
  validation and MemberIDs() logic that would need coverage under apply
  mode

Proposed Scenario Work

Expand the existing test/e2e/scenarios/control-plane/groups/scenario.yaml
by adding steps that use the already-existing overlay
overlays/002-update-members/:

1. Add an apply UPDATE step after the current 004-plan-idempotent
   step (before delete):

   • Set inputOverlayDirs: [overlays/002-update-members]
   • Run apply -f ... --auto-approve
   • Assert plan.changes contains a CREATE for groups-emea-runtime and
     an UPDATE for groups-shared-group
   • Assert NO DELETE for groups-staging-runtime (apply mode should leave
     undeclared resources alone)
   • Verify summary.failed: 0

2. Add post-update verification:

   • Dump the group and verify the member list now includes the EMEA runtime
     ID and the prod runtime ID (2 members)
   • Optionally verify that the staging runtime still exists (apply didn't
     delete it) via a get command

3. Add plan idempotency check after the update to confirm no further
   changes are needed

4. Update the delete cleanup step to use the overlay so all 3 created CPs
   (prod, emea, group) plus the orphaned staging runtime are deleted

Acceptance Criteria

• The groups scenario exercises an apply-driven UPDATE action that
  changes group membership
• Assertions verify that apply mode does NOT delete the removed member
  (staging runtime), distinguishing apply behavior from sync behavior
• Post-update dump verifies the group's member list reflects the change
• Plan idempotency is verified after the member update
• All resources (including the orphaned staging runtime) are cleaned up
• make test-e2e-scenarios SCENARIO=control-plane/groups passes

Reference Patterns

• test/e2e/scenarios/control-plane/sync-groups/scenario.yaml — step
  002-update-group-members demonstrates the sync-mode equivalent of this
  change, with the same member swap (staging → EMEA)
• test/e2e/scenarios/control-plane/groups/overlays/002-update-members/control-plane.yaml
  — the overlay already exists and is ready to use
• test/e2e/scenarios/control-plane/apply/scenario.yaml — step
  002-apply-update demonstrates the apply UPDATE assertion pattern for
  standard control planes

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by E2E Coverage Scanner · opus46 · 385.2 AIC · ⌖ 30.6 AIC · ⊞ 6.7K · ◷

• expires on Oct 17, 2026, 4:59 AM UTC