Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/e2e/vm-scanning-lib.sh`:
- Around line 31-35: The verify_kvm_available function currently aggregates
devices.kubevirt.io/kvm across all nodes and uses a regex that can miss
multi-token all-zero results (e.g. "0 0") and doesn't limit to worker nodes;
update it to query only worker nodes (e.g., use a node selector/label like
node-role.kubernetes.io/worker or exclude control-plane/master labels) and then
parse the returned tokens individually to ensure at least one node has a
capacity > 0; produce a list/array from the kubectl jsonpath output for the
symbol verify_kvm_available and iterate over each token, failing (die) only if
every token is zero/empty or if no worker nodes are found.

In `@tests/testmetrics/scrape.go`:
- Around line 234-242: The ScrapeComponent function builds PodCollectOptions
without populating RestConfig, which breaks port-forward transport; update
ScrapeComponent signature to accept a *rest.Config parameter and pass it into
the PodCollectOptions.RestConfig field so that when transport ==
TransportPortForward the port-forward logic receives the required rest
configuration (modify references in ScrapeComponent and the PodCollectOptions
construction to include RestConfig).

In `@tests/vm_scanning_e2e_utils_test.go`:
- Around line 194-195: The test currently treats PodPending as ready via the
phaseReady boolean; change the readiness check to require pod.Status.Phase ==
coreV1.PodRunning AND the PodReady condition equals coreV1.ConditionTrue instead
of allowing PodPending. Update the phaseReady assignment (and the equivalent
block later) to inspect pod.Status.Conditions for coreV1.PodReady and compare
its Status to coreV1.ConditionTrue, and use that combined check when gating
hostPath evidence collection (replace references to coreV1.PodPending with the
PodReady-condition check).

In `@tests/vm_scanning_suite_test.go`:
- Around line 1223-1225: The assertion requiring acks_received > 0 contradicts
the known-gap note; update the test around requirePositive(comp, cq[5], ...) so
it is conditional: if the ACK-propagation fix/feature is enabled (use your
existing feature toggle or flag check) then assert > 0 via requirePositive(comp,
cq[5], ...), otherwise relax or skip the check (e.g., assert >= 0 or skip the
assertion) and keep the explanatory message; reference the existing call site
requirePositive, the comp variable and cq[5] context when making the conditional
change.
- Around line 762-765: When Create returns IsAlreadyExists, fetch the current
Secret via s.k8sClient.CoreV1().Secrets(s.namespace).Get(ctx, secret.Name,
metaV1.GetOptions{}), copy the existing Secret's ResourceVersion (and any other
server-set metadata you need) onto the local secret object, then call Update
with that updated secret; this ensures the Update on the secret variable
succeeds instead of being rejected for a missing/incorrect resourceVersion.

In `@tests/vm_scanning_utils_test.go`:
- Around line 60-79: Reorder loadVMScanConfig so environment-only prerequisites
(e.g., requireEnv for RHEL_ACTIVATION_ORG and RHEL_ACTIVATION_KEY) are validated
before any host-binary probes; specifically, move the requireEnv checks for
activation-related variables to occur prior to calling discoverVirtctlPath and
discoverRoxagentBinaryPath in loadVMScanConfig (and make the same change in the
similar block around lines 106-123), so missing activation env vars fail fast
and are not masked by local binary discovery errors.
- Around line 25-28: The two constants defaultRepo2CPEPrimaryURL and
defaultRepo2CPEFallbackURL are identical, so on primary fetch failure the code
just retries the same endpoint; change the fallback to be a true fallback by
either (A) requiring the ROXAGENT_REPO2CPE_FALLBACK_URL env var be set and use
that for defaultRepo2CPEFallbackURL, or (B) derive a local file path under the
repo/artifacts directory and set defaultRepo2CPEFallbackURL to that path; update
the constant(s) in tests/vm_scanning_utils_test.go (and any test setup that
depends on defaultRepo2CPEFallbackURL) so the fallback is distinct from
defaultRepo2CPEPrimaryURL and tests assert using the fallback path when the
primary URL is unreachable.

In `@tests/vmhelpers/guest.go`:
- Around line 62-68: The current branch treats any non-transport pgrep error as
"idle"; change it to only treat the pgrep exit-code-1 (no matches) as idle and
propagate all other command failures. In the block handling err (after
errors.Is(err, errSSHTransport)), detect whether err is an *exec.ExitError and
extract the exit status (use ExitError.ExitCode() or
syscall.WaitStatus.ExitStatus()); if the exit code == 1 return (true, "no RHSM
uploader processes", nil), otherwise return (false, "", err) so real pgrep
failures are surfaced. Update the logic around the err handling in the function
that invokes pgrep in tests/vmhelpers/guest.go accordingly.

In `@tests/vmhelpers/ssh_command_framework.go`:
- Around line 104-126: The retry loop in retryOnSSHTransport currently retries
any error matching errSSHTransport, causing terminal failures to spin; introduce
and use a distinct sentinel errRetryableSSHTransport for only retryable
transport glitches and update runSSHCommandWithFramework so it returns
errRetryableSSHTransport for transient/socket/connection issues but returns the
original errSSHTransport (or a wrapped error not matching
errRetryableSSHTransport) for terminal auth failures (bad key/user); then change
callers to pass the same fn into retryOnSSHTransport unchanged (so
retryOnSSHTransport continues to check errors.Is(..., errRetryableSSHTransport)
rather than errSSHTransport) ensuring terminal auth errors are returned
immediately while only genuine retryable transport errors are retried.

In `@tests/vmhelpers/virtctl_ssh.go`:
- Around line 29-39: The buildVirtctlSSHCommand function currently uses
strconv.Quote which emits Go string literals unsafe for POSIX shells; update
buildVirtctlSSHCommand to produce shell-safe single-quoted arguments (escape any
single quote by closing, inserting '"'"', and reopening) or call a known library
such as github.com/alessio/shellescape.Quote for each arg instead of
strconv.Quote so remote --command receives correct POSIX-quoted arguments; keep
the existing join behavior (strings.Join with spaces) and replace references to
strconv.Quote in buildVirtctlSSHCommand accordingly.

In `@tests/vmhelpers/virtctl.go`:
- Around line 136-157: The current formatRemoteCommandStreamsForInlineLog only
truncates stdout but not stderr, allowing unbounded stderr into logs; modify the
function to apply truncateMiddleLines(stderr, inlineLogMaxHeadTailLines) (after
trimming) before writing the "stderr:\n" block so both stderr and stdout are
subject to the same large-output guard; keep use of strings.TrimSpace, preserve
labels ("stderr:" then "stdout:"), and reuse the existing truncateMiddleLines
and inlineLogMaxHeadTailLines symbols.

---

Nitpick comments:
In `@tests/testmetrics/parse.go`:
- Around line 123-143: parseCounter currently uses strings.HasPrefix(line,
metricPrefix) which can incorrectly match longer metric names; update
parseCounter to ensure the character immediately after metricPrefix in the line
(if any) is either '{' (labels), whitespace (space or tab), or end-of-line so
you only match the exact metric name, and apply the identical validation to
parseCounterWithLabel; locate the checks using metricPrefix inside parseCounter
and parseCounterWithLabel and replace the simple HasPrefix acceptance with this
exact-name post-character check before parsing fields and values.

In `@vm-image.sh`:
- Around line 51-52: The DISK_NAME assignment uses a non-deterministic pipeline
("find ... | head -1") which can pick different files; update the logic around
DISK_NAME (the line that constructs DISK_NAME using WORKDIR) to use a
deterministic first-match find invocation (e.g., find ... -print -quit) or,
better, enumerate matches and validate there is exactly one .qcow2/.img file and
error if zero or more than one; ensure the echo "==> Disk: $DISK_NAME" only runs
after successful validation.
- Around line 60-64: The script currently bakes plaintext credentials into
customize.sh by interpolating REGISTER_ARGS; instead stop expanding
REGISTER_ARGS into the file and have the script read credentials from
environment variables at runtime (e.g. REGISTER_USERNAME and REGISTER_PASSWORD)
and invoke subscription-manager without placing secrets on the command line (for
example pipe or heredoc to subscription-manager or otherwise provide password
via stdin), then explicitly unset those env vars and remove WORKDIR after use;
update the code that writes customize.sh (and the script body) to reference
REGISTER_USERNAME/REGISTER_PASSWORD and to avoid passing secrets as command-line
args to subscription-manager (use stdin/heredoc/piping) and ensure cleanup/unset
of the env vars inside the customize.sh script.