Drop ticket references from e2e hardening and note it in the changelog

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Author: lelia

.github/workflows/e2e-test.yml

@@ -47,9 +47,9 @@ jobs:
             validate: tests/e2e/validate-reachability.sh
             setup-node: "true"
             # The tier-1 reachability backend intermittently returns empty
-            # results while the CLI reports success (ENG-5093). The probe
-            # exits 0 when the facts file has alerted components; anything
-            # else is retried before validation fails the job.
+            # results while the CLI reports success. The probe exits 0 when
+            # the facts file has alerted components; anything else is
+            # retried before validation fails the job.
             retry-probe: bash tests/e2e/reach-facts-probe.sh tests/e2e/fixtures/simple-npm
 
           - name: gitlab
@@ -109,7 +109,7 @@ jobs:
           # when the scan output looks complete, and a run that fails it is
           # re-run on the assumption of a transient backend failure. A
           # persistent incomplete result still reaches validation. Validation
-          # only treats the explicit ENG-5093 zero-project backend signature as
+          # only treats the explicit zero-project backend signature as
           # inconclusive; any other empty result remains a failure. Retries are
           # surfaced as warning annotations so flake frequency stays visible.
           max_attempts=3
@@ -125,7 +125,7 @@ jobs:
               echo "diagnostics=true" >> "$GITHUB_OUTPUT"
               break
             fi
-            echo "::warning title=e2e-${{ matrix.name }} transient retry::attempt ${attempt} failed the completeness probe (suspected backend transient, see ENG-5093); retrying"
+            echo "::warning title=e2e-${{ matrix.name }} transient retry::attempt ${attempt} failed the completeness probe (suspected backend transient); retrying"
             echo "e2e-${{ matrix.name }}: retry after attempt ${attempt} — completeness probe failed (suspected transient)" >> "$GITHUB_STEP_SUMMARY"
             attempt=$((attempt+1))
             sleep 30

CHANGELOG.md

@@ -16,6 +16,14 @@
 - Pinned the `hatchling` build backend and the `uv` binary used in the
   Dockerfile.
 
+### Changed: e2e reachability jobs retry transient empty results
+
+- Reachability e2e runs that report success with no alerted components in the
+  facts file are retried up to three times as a suspected transient backend
+  failure. After retries, only the known zero-project backend signature is
+  classified as inconclusive — any other empty result still fails — and e2e
+  jobs upload their logs and reports as diagnostics on failure.
+
 ## 2.5.9
 
 ### Changed: bump pinned @coana-tech/cli to 15.10.3

tests/e2e/reach-facts-probe.sh

@@ -3,8 +3,8 @@
 #
 # Used by the e2e workflow's retry-probe hook: a --reach run against the
 # known-vulnerable fixture that reports success but yields no alerted
-# components is the signature of a transient tier-1 backend failure
-# (ENG-5093), so the run is worth repeating before validation fails the job.
+# components is the signature of a transient tier-1 backend failure,
+# so the run is worth repeating before validation fails the job.
 set -euo pipefail
 
 TARGET="${1:?usage: reach-facts-probe.sh <target-path>}"

tests/e2e/validate-reachability.sh

@@ -36,20 +36,20 @@ echo "PASS: Reachability facts file present at $FACTS_PATH"
 
 # The tier-1 backend intermittently returns the known fixture as one orphaned
 # component with zero projects, so Coana has no vulnerability to analyze even
-# though manifest upload, facts generation, and scan finalization all succeed
-# (ENG-5093). After the workflow's bounded retries, classify only that explicit
+# though manifest upload, facts generation, and scan finalization all succeed.
+# After the workflow's bounded retries, classify only that explicit
 # upstream signature as inconclusive. Any other empty facts result still fails,
 # including the important regression case where Coana received a vulnerability
 # but the CLI lost its alerted component.
 if ! bash tests/e2e/reach-facts-probe.sh tests/e2e/fixtures/simple-npm; then
   if grep -q "Found 1 manifest files for reachability upload" "$LOG" && \
      grep -q "Found 0 projects across 0 ecosystems to analyze" "$LOG" && \
      grep -q "Filtered out 1 orphaned component" "$LOG"; then
-    echo "::warning title=e2e-reachability inconclusive backend result::ENG-5093: tier-1 returned the known zero-project/orphaned-component signature after retries; core reachability execution and finalization passed"
-    echo "e2e-reachability: inconclusive after retries — known ENG-5093 zero-project backend signature; diagnostics uploaded" >> "${GITHUB_STEP_SUMMARY:-/dev/null}"
+    echo "::warning title=e2e-reachability inconclusive backend result::tier-1 returned the known zero-project/orphaned-component signature after retries; core reachability execution and finalization passed"
+    echo "e2e-reachability: inconclusive after retries — known zero-project backend signature; diagnostics uploaded" >> "${GITHUB_STEP_SUMMARY:-/dev/null}"
     exit 0
   fi
-  echo "FAIL: no components with alerts in .socket.facts.json and the known ENG-5093 backend signature was not present"
+  echo "FAIL: no components with alerts in .socket.facts.json and the known backend signature was not present"
   exit 1
 fi