fix(test): the Class A shrink guard only ran on helm 4 (backend#2341)

[LukasWodka]

develop is red right now — #790 merged with its four CI failures unfixed. I had diagnosed and fixed them locally but was holding the push for a full bats run, and the merge landed first. That sequencing was my error: the fix should have gone up the moment it was verified, with bats as confirmation rather than a gate on sharing it.

Four failures, two causes.

1. The guard asserted helm 4's error text, and CI pins 3.15.4

standard-checks.yml installs helm v3.15.4; this was written against v4.1.1. Two version-specific things, both mine:

• the schema refusal reads missing property 'x' on helm 4 and x is required on helm 3 — so all four checks saw the render correctly refused and judged it "refused, but not for the expected reason";
• --skip-schema-validation didn't exist before helm 3.16, so the two template-layer cases failed on an unknown flag rather than on the chart.

Now matched on the preamble — don't meet the specifications — which is identical in both versions and still distinguishes a schema refusal from the template one. The --skip-schema-validation half is feature-detected and skips loudly where the flag is absent rather than passing silently:

 SKIP template fail-closed: this helm (v3.15.4) has no --skip-schema-validation;
the schema layer above is what is exercised here.

2. A pipe into an early-closing reader — in the guard's own error path

printf '%s' "$out" | head -2 SIGPIPEs its producer under set -euo pipefail and returns 141. That's the backend#1778 class this repo has a dedicated scanner for, and it's what bothquality / pipefail early-close and bats test 803 were reporting — three of the four red checks were this one line.

Replaced with the documented here-string idiom. The scanner then caught my replacement for cause 1 too:helm template --help | grep -q --skip-schema-validation closes the pipe on its first hit. Now captured into a variable and matched with case, so there's no pipe at all.

Two instances of one class, inside a fix for a different class — the gate earned its keep twice in one change.

Verified on the post-merge develop

• pipefail-early-close.sh — exit 0, no offenders
• pipefail-early-close.bats — 42/42
• shellcheck -S warning -x — clean
• the guard's five cases — green
• make drift — 13/13

No chart files touched, so no Chart.yaml bump: the version-bump gate watches client/* and this is scripts/tests/.

The other five guards added this session were also written against helm 4; CI's drift log shows all of them passing on 3.15.4, so only this one carried version-specific assertions.

🤖 Generated with Claude Code

---

Note

Low Risk
Test-script only; no chart or runtime behavior changes. Risk is limited to slightly weaker template-layer coverage on Helm < 3.16 (loud skip).

Overview
Makes the Class A “lists cannot silently shrink” guard pass on CI’s Helm v3.15.4, not only Helm 4.

Schema refusals now match the shared preamble (don't meet the specifications) instead of Helm 4’s missing property '…' wording. Template-layer cases that need --skip-schema-validation are feature-detected and skip loudly when the flag is missing.

Also replaces printf | head (and avoids grep -q on helm help) with here-strings/case so set -euo pipefail no longer dies with SIGPIPE 141 in the error path.

^{Reviewed by Cursor Bugbot for commit 71ee222. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 71ee222. Configure here.}

[LukasWodka]

/fr-pass