[robfrank]

Closes #59

helm-unittest 0.5.2 (pinned in the Makefile) only knows errorMessage on failedTemplate. It drops errorPattern when it decodes the YAML, and a failedTemplate with no message passes on any render failure (validator source at v0.5.2: FailedTemplateValidator has a single ErrorMessage field). This PR switches all 17 errorPattern assertions to the exact errorMessage. Doing that turned up one test that was passing for the wrong reason: config-chown fails when mountPath does not contain the config dir failed on the volumeMounts guard ("arcadedb.configDirectory (/var/lib/arcadedb/config) is not on any volumeMounts entry"), not on the config-chown guard it is named for. It now mounts the custom config directory, so the config-chown guard is the one that fires. To stop this from coming back, make test-unit now runs ci/check-failed-template.sh:

1. Static check: every failedTemplate in tests/*_test.yaml must carry errorMessage. Any errorPattern is rejected, and so is {}, an empty block, or a misspelled key.
2. Negative control: tests/negative-control/failed_template_control.yaml has three assertions that must all fail: a wrong message, a prefix of the real message, and a render that succeeds. If any of them passes, the installed plugin has stopped checking messages, and the check fails. The file name does not end in _test.yaml, so the normal suite glob skips it. tests/ is in .helmignore, so the file is not packaged.

The README testing section now documents the rule.

I chose this over upgrading helm-unittest to 1.x, which matches errorPattern. The upgrade is a major-version jump, and errorMessage gives a stricter check on any plugin version. The script header says how to relax check 1 after an upgrade.

Test plan

• make test-unit: 364/364 pass, static check OK, negative control 3/3 failed as expected
• make lint
• With a copy of each affected suite where errorPattern: is renamed to errorMessage:, the "Actual" output shows each real message. Each new errorMessage is that message verbatim.
• Static check run against main's tests: reports every errorPattern line
• Static check with probes (failedTemplate: {}, typo key errorMesage, a commented block with errorPattern, an empty block at EOF): all 4 reported, exit 1
• Negative control with one control assertion made correct: reports 2 failed, 1 passed and exits 1
• CI unittest job (Helm v4.1.4) green

Coverage

Invariant: every failedTemplate assertion proves that the render fails with the stated message.

Entry point	Status
backup_directory_test.yaml (2)	fixed here: exact errorMessage
logging_config_test.yaml (3)	fixed here
observability_test.yaml (4)	fixed here
servicemonitor_test.yaml (2)	fixed here
statefulset_test.yaml (6)	fixed here. One was asserting the wrong guard and its setup is corrected
Existing errorMessage assertions (13, in certificate/config_seed/gremlin_port/helpers/native/quorum_guard/service)	already exact. The negative control shows the plugin checks them
Future assertions	ci/check-failed-template.sh in make test-unit (CI unittest job)

Known gaps: None for failedTemplate. helm-unittest 0.5.2 also silently ignores unknown keys on other assertion types. That is outside this issue's scope and was not observed in the current suites.

Adversarial pass

I could not run it: this session has no subagent tool, so the independent Phase 1.5 reviewer was not spawned. A self-check turned up the masked config-chown test described above, which is fixed here.

Review cycles

• cycle 1: 3bf2565, initial fix. No bot review came in within the 15-minute window. This repo has no Claude Code Review workflow (.github/workflows has only lint, integration, latest-image and release), and PR feat(#45): pass the HA fallback root password as an env var, not -D #55 has no claude comments either. CI is green (6/6).

Deferred items

None.

Final state: timeout (no automated reviewer is configured on this repo). A human review is needed.

🤖 Generated with Claude Code