SSO redirect guard reads a layer that failed to build as an empty one #4357

🤖 Generated by the Agentic Engineer

Evidence

scripts/tests/test-oauth2-proxy-sso-redirects.sh renders each provider layer with:

{
  kubectl kustomize "${dir}"
  printf '\n---\n'
} >>"${rendered}" 2>"${workdir}/render.err" ||
  fail "... failed to build ..."

A brace group's exit status is its last command's, which is printf's, so the || fail never fires when kubectl kustomize fails. A layer that does not build contributes nothing to the render, and the guard then checks the remaining layers as if the failed one held no routes.

Found while porting this guard to the platform template (devantler-tech/platform-template#213). There, one layer failed to build after a change, and the guard reported an unrelated error ("no route puts oauth2-proxy's own host behind it") instead of the build failure.

Impact

It fails open. A protected route in a layer that does not build is never checked for its Dex callback or for a fixed redirect header. Other CI jobs build the same layers, so a broken build is unlikely to reach main unnoticed. But this guard can still report success over a layer it never read.

Expected behaviour

A layer that fails to build fails the guard and names the layer.

Acceptance criteria

• The guard checks kubectl kustomize's own exit status, as the template port does: run it on its own with || fail, then append the separator.
• A test or a documented manual ablation shows that a deliberately broken layer fails the guard with the build error, not a later symptom.

Size: XS.