Upgrade helm in console#16607
Open
sowmya-sl wants to merge 5 commits into
Open
Conversation
Migrate all Go import paths under pkg/helm/ (actions, chartproxy, chartverifier, handlers) to the Helm v4 module path as part of the Helm SDK upgrade.
Helm v4 introduces interface-based return types and restructured packages. This updates all call sites to handle the new Releaser interface with type assertions, adapts to the removed Configuration.Init() logger parameter, replaces DryRun/ClientOnly with DryRunStrategy, and converts dependency slice types for CheckDependencies. Co-authored-by: Cursor <cursoragent@cursor.com>
Helm v4 returns release.Releaser and chart.Dependency interface types instead of concrete v1 release and v2 dependency types. Update install, upgrade, list, history, template, and uninstall code to type-assert release results, convert chart dependency slices for CheckDependencies, and use the new Configuration.Init and Install action fields.
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
Contributor
|
Skipping CI for Draft Pull Request. |
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: sowmya-sl The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Contributor
|
Caution Review failedAn error occurred during the review process. Please try again later. WalkthroughThis PR migrates the codebase from Helm v3 to Helm v4 by updating the direct dependency in ChangesHelm v3→v4 Dependency and API Migration
🎯 4 (Complex) | ⏱️ ~75 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (2 errors, 3 warnings, 1 inconclusive)
✅ Passed checks (9 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Tools execution failed with the following error: Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error) Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (4)
pkg/helm/actions/auth_test.go (1)
72-73:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winDon't discard the fixture read failures.
If
server.crtorserver.keyis missing, this test keeps going with empty data and fails later insetUpAuthenticationwith a misleading PEM-validation error. Assert both reads succeed here. As per coding guidelines, Go code should never ignore error returns.Suggested fix
- cert, _ := os.ReadFile("./server.crt") - key, _ := os.ReadFile("./server.key") + cert, err := os.ReadFile("./server.crt") + require.NoError(t, err) + key, err := os.ReadFile("./server.key") + require.NoError(t, err)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helm/actions/auth_test.go` around lines 72 - 73, The test currently discards errors from os.ReadFile when loading "./server.crt" and "./server.key" which can lead to misleading PEM errors in setUpAuthentication; update the test to capture and assert the read errors for both cert and key (e.g., check err after reading into cert and key and fail the test with t.Fatalf or use require.NoError) so the test stops with a clear message if the fixture files are missing or unreadable.Source: Coding guidelines
pkg/helm/actions/config.go (1)
51-58:⚠️ Potential issue | 🟠 Major | 🏗️ Heavy liftHandle
conf.Initfailures (and OCI registry errors) instead of discarding them.In
pkg/helm/actions/config.go(lines 51-58),conf.Init(...)is called but its returnederroris ignored, leaving*action.Configurationpotentially partially initialized. ChangeGetActionConfigurationsto return(*action.Configuration, error)and plumb it through the handler function type inpkg/helm/handlers/handlers.go. Also,GetDefaultOCIRegistry()’serris only logged; return/handle it the same way to avoid continuing with a nil/invalidRegistryClient.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helm/actions/config.go` around lines 51 - 58, Update GetActionConfigurations to return (*action.Configuration, error), call conf.Init and check its returned error instead of discarding it (return nil, err on failure), and likewise propagate any error from GetDefaultOCIRegistry instead of only logging it; set conf.RegistryClient only when registryClient is non-nil and no error occurred. Then update the handler function type in pkg/helm/handlers/handlers.go (the handler signature you use to build handlers) to accept/return the error from GetActionConfigurations and propagate that error up to callers so initialization failures are handled rather than ignored. Ensure references to conf.Init, GetDefaultOCIRegistry, conf.RegistryClient, and the handler type are updated consistently.pkg/helm/actions/get_chart_test.go (1)
89-96:⚠️ Potential issue | 🔴 CriticalFix Helm v4 test fixture API usage (action.Configuration + chartutil)
pkg/helm/actions/get_chart_test.gostill uses removed Helm v3 configuration members:
chartutil.DefaultCapabilitiesis undefinedaction.Configurationno longer has aLogfieldThese issues repeat at lines 89-96, 202-209, and 336-343, and the same Helm v4 mismatches also break
pkg/helm/actions/get_registry_test.go/pkg/helm/actions/get_release_test.go(includingrelease.StatusDeployed), sogo test ./pkg/helm/actionsfails to build. Update the fixtures to the Helm v4 configuration/types instead of carrying v3 fields forward.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helm/actions/get_chart_test.go` around lines 89 - 96, Tests are still using Helm v3-only fields: remove the v3-only action.Configuration.Log and chartutil.DefaultCapabilities usages and migrate the fixtures to the Helm v4 initialization pattern by creating an action.Configuration via the v4 helper (create a configuration instance and call the v4 init/new routine to wire RESTClientGetter, Releases (storage.Init(driver.NewMemory())), and KubeClient (kubefake.PrintingKubeClient)), and where tests referenced chart capabilities replace chartutil.DefaultCapabilities with constructing a chartutil.Capabilities using the Helm v4 constructor/helper; also update any v3 release constants (e.g. release.StatusDeployed) to the Helm v4 equivalents. Ensure you update the three fixture blocks (the ones around action.Configuration in the diff) and mirror the same changes in pkg/helm/actions/get_registry_test.go and get_release_test.go.Source: Linters/SAST tools
pkg/helm/actions/list_releases.go (1)
39-40:⚠️ Potential issue | 🟠 Major | ⚡ Quick winHandle releases with no chart before copying metadata.
The new
limitInfopath dereferencesrel.Chart.Metadataunconditionally. A single release withChart == nilnow panics the whole list call instead of returning the other releases.Suggested fix
for _, rel := range releases { + var limitedChart *chart.Chart + if rel.Chart != nil { + limitedChart = &chart.Chart{ + Metadata: rel.Chart.Metadata, + } + } info := release.Release{ Name: rel.Name, Version: rel.Version, Namespace: rel.Namespace, Info: rel.Info, - Chart: &chart.Chart{ - Metadata: rel.Chart.Metadata, - }, + Chart: limitedChart, } limited = append(limited, &info) }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helm/actions/list_releases.go` around lines 39 - 40, The code unconditionally dereferences rel.Chart.Metadata (in the limitInfo path) and will panic if rel.Chart is nil; update the logic in list_releases.go to check rel.Chart != nil before accessing rel.Chart.Metadata (e.g., inside the code that builds the Chart: &chart.Chart{ Metadata: rel.Chart.Metadata }). If rel.Chart is nil, either skip copying Metadata and leave Chart nil/empty on the returned release or populate Metadata with an empty/default metadata object so the function returns other releases without panicking.
🧹 Nitpick comments (1)
pkg/helm/actions/uninstall_release.go (1)
26-29: Guard the Helm v4Releaseassertion when recording uninstall metrics (hardening).
Helm v4’s successful non-dry-runaction.Uninstall.RunpopulatesUninstallReleaseResponse.Releasewith*helm.sh/helm/v4/pkg/release/v1.Release, so the current assertion is unlikely to panic today; still, sinceReleaseisinterface{}, adding anoktype-assert guard (andresp != nil) prevents metrics from crashing on unexpected/nil shapes.Suggested fix
- ch := resp.Release.(*release.Release).Chart - if ch != nil && ch.Metadata != nil && ch.Metadata.Name != "" && ch.Metadata.Version != "" { - metrics.HandleconsoleHelmUninstallsTotal(ch.Metadata.Name, ch.Metadata.Version) - } + if rel, ok := resp.Release.(*release.Release); ok && rel != nil { + ch := rel.Chart + if ch != nil && ch.Metadata != nil && ch.Metadata.Name != "" && ch.Metadata.Version != "" { + metrics.HandleconsoleHelmUninstallsTotal(ch.Metadata.Name, ch.Metadata.Version) + } + } ... - ch := resp.Release.(*release.Release).Chart - if ch != nil && ch.Metadata != nil && ch.Metadata.Name != "" && ch.Metadata.Version != "" { - metrics.HandleconsoleHelmUninstallsTotal(ch.Metadata.Name, ch.Metadata.Version) - } + if rel, ok := resp.Release.(*release.Release); ok && rel != nil { + ch := rel.Chart + if ch != nil && ch.Metadata != nil && ch.Metadata.Name != "" && ch.Metadata.Version != "" { + metrics.HandleconsoleHelmUninstallsTotal(ch.Metadata.Name, ch.Metadata.Version) + } + }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helm/actions/uninstall_release.go` around lines 26 - 29, The current code directly type-asserts resp.Release to *release.Release which can panic; update the uninstall metrics block to first ensure resp != nil, perform a safe type assertion like r, ok := resp.Release.(*release.Release), and only if ok and r != nil and r.Chart != nil and r.Chart.Metadata != nil and r.Chart.Metadata.Name != "" and r.Chart.Metadata.Version != "" call metrics.HandleconsoleHelmUninstallsTotal(r.Chart.Metadata.Name, r.Chart.Metadata.Version); this replaces direct use of resp.Release.(*release.Release).Chart with the guarded r.Chart path.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 230: The go.mod currently pulls helm.sh/helm/v3 v3.17.1 (transitively via
github.com/redhat-certification/chart-verifier) which is vulnerable; update the
dependency graph by either (A) bumping
github.com/redhat-certification/chart-verifier to a newer version that itself
depends on a patched helm v3 (so the transitive helm.sh/helm/v3 resolves to >=
v3.17.3/v3.18.4), or (B) add a go.mod replace directive to pin helm.sh/helm/v3
to a patched release (e.g., v3.17.3 or v3.18.4) to override the transitive
v3.17.1; locate references to github.com/redhat-certification/chart-verifier and
helm.sh/helm/v3 in go.mod and update the chart-verifier module version or add
the replace line, then run go mod tidy && go mod vendor (if vendored) and verify
the module graph no longer contains helm.sh/helm/v3 v3.17.1.
In `@pkg/helm/actions/get_release.go`:
- Line 15: The code currently returns releases.(*release.Release) directly which
can panic if cmd.Run returns a different release.Releaser implementation; change
the direct assertion to a guarded one: use rel, ok :=
releases.(*release.Release) (referencing the releases variable and the
release.Release type) and if !ok return a descriptive error (e.g., using
fmt.Errorf or errors.New) instead of panicking, otherwise return rel, nil.
Ensure the function that calls cmd.Run (the code containing the releases
variable and the return) uses this guarded pattern.
In `@pkg/helm/actions/template.go`:
- Around line 28-35: The code currently sets client.DryRunStrategy =
action.DryRunNone which in Helm v4 is not a client-side dry-run and still
interacts with the server; change the dry-run strategy to a client-only dry-run
by setting client.DryRunStrategy = action.DryRunClient in the same
initialization block (the code around actions.RenderManifests, client.Run(ch,
vals), and the Install runner) so that Install.RunWithContext treats the
operation as a dry-run (isDryRun true / interactWithServer false) and does not
call i.cfg.Releases.Create or performInstall.
---
Outside diff comments:
In `@pkg/helm/actions/auth_test.go`:
- Around line 72-73: The test currently discards errors from os.ReadFile when
loading "./server.crt" and "./server.key" which can lead to misleading PEM
errors in setUpAuthentication; update the test to capture and assert the read
errors for both cert and key (e.g., check err after reading into cert and key
and fail the test with t.Fatalf or use require.NoError) so the test stops with a
clear message if the fixture files are missing or unreadable.
In `@pkg/helm/actions/config.go`:
- Around line 51-58: Update GetActionConfigurations to return
(*action.Configuration, error), call conf.Init and check its returned error
instead of discarding it (return nil, err on failure), and likewise propagate
any error from GetDefaultOCIRegistry instead of only logging it; set
conf.RegistryClient only when registryClient is non-nil and no error occurred.
Then update the handler function type in pkg/helm/handlers/handlers.go (the
handler signature you use to build handlers) to accept/return the error from
GetActionConfigurations and propagate that error up to callers so initialization
failures are handled rather than ignored. Ensure references to conf.Init,
GetDefaultOCIRegistry, conf.RegistryClient, and the handler type are updated
consistently.
In `@pkg/helm/actions/get_chart_test.go`:
- Around line 89-96: Tests are still using Helm v3-only fields: remove the
v3-only action.Configuration.Log and chartutil.DefaultCapabilities usages and
migrate the fixtures to the Helm v4 initialization pattern by creating an
action.Configuration via the v4 helper (create a configuration instance and call
the v4 init/new routine to wire RESTClientGetter, Releases
(storage.Init(driver.NewMemory())), and KubeClient
(kubefake.PrintingKubeClient)), and where tests referenced chart capabilities
replace chartutil.DefaultCapabilities with constructing a chartutil.Capabilities
using the Helm v4 constructor/helper; also update any v3 release constants (e.g.
release.StatusDeployed) to the Helm v4 equivalents. Ensure you update the three
fixture blocks (the ones around action.Configuration in the diff) and mirror the
same changes in pkg/helm/actions/get_registry_test.go and get_release_test.go.
In `@pkg/helm/actions/list_releases.go`:
- Around line 39-40: The code unconditionally dereferences rel.Chart.Metadata
(in the limitInfo path) and will panic if rel.Chart is nil; update the logic in
list_releases.go to check rel.Chart != nil before accessing rel.Chart.Metadata
(e.g., inside the code that builds the Chart: &chart.Chart{ Metadata:
rel.Chart.Metadata }). If rel.Chart is nil, either skip copying Metadata and
leave Chart nil/empty on the returned release or populate Metadata with an
empty/default metadata object so the function returns other releases without
panicking.
---
Nitpick comments:
In `@pkg/helm/actions/uninstall_release.go`:
- Around line 26-29: The current code directly type-asserts resp.Release to
*release.Release which can panic; update the uninstall metrics block to first
ensure resp != nil, perform a safe type assertion like r, ok :=
resp.Release.(*release.Release), and only if ok and r != nil and r.Chart != nil
and r.Chart.Metadata != nil and r.Chart.Metadata.Name != "" and
r.Chart.Metadata.Version != "" call
metrics.HandleconsoleHelmUninstallsTotal(r.Chart.Metadata.Name,
r.Chart.Metadata.Version); this replaces direct use of
resp.Release.(*release.Release).Chart with the guarded r.Chart path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 2d74fa45-705f-4576-8d1b-d23e560d3ce0
⛔ Files ignored due to path filters (264)
go.sumis excluded by!**/*.sumvendor/github.com/ProtonMail/go-crypto/openpgp/clearsign/clearsign.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/errors/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/compressed.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/read.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ProtonMail/go-crypto/openpgp/write.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/internal/sha3/xor_unaligned.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cloudflare/circl/sign/sign.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/dylibso/observe-sdk/go/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/dylibso/observe-sdk/go/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/dylibso/observe-sdk/go/adapter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/dylibso/observe-sdk/go/bucket.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/dylibso/observe-sdk/go/event.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/dylibso/observe-sdk/go/listener.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/dylibso/observe-sdk/go/otel_formatter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/dylibso/observe-sdk/go/telemetry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/dylibso/observe-sdk/go/trace_ctx.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/dylibso/observe-sdk/go/wasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/extism/go-sdk/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/extism/go-sdk/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/extism/go-sdk/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/extism/go-sdk/extism-runtime.wasmis excluded by!**/*.wasm,!**/vendor/**,!vendor/**vendor/github.com/extism/go-sdk/extism-runtime.wasm.versionis excluded by!**/vendor/**,!vendor/**vendor/github.com/extism/go-sdk/extism.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/extism/go-sdk/host.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/extism/go-sdk/module.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/extism/go-sdk/plugin.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/extism/go-sdk/runtime.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/LICENSE_TEMPLATEis excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/LICENSE_TEMPLATE_GOis excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/aggregator/aggregator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/clusterreader/caching_reader.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/clusterreader/direct_reader.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/clusterreader/dynamic_reader.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/collector/collector.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/engine/engine.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/engine/reader.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/engine/status_reader.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/event/event.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/event/type_string.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/statusreaders/common.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/statusreaders/default.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/statusreaders/deployment.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/statusreaders/generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/statusreaders/pod_controller.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/statusreaders/replicaset.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/polling/statusreaders/statefulset.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/status/core.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/status/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/status/generic.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/status/status.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/status/util.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/watcher/blind_status_watcher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/watcher/default_status_watcher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/watcher/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/watcher/dynamic_informer_factory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/watcher/event_funnel.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/watcher/object_filter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/watcher/object_status_reporter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/watcher/restscopestrategy_string.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/watcher/unschedulable.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/kstatus/watcher/watcher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/object/error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/object/field.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/object/infos.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/object/objmetadata.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/object/objmetadata_set.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/object/strings.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/object/unstructured.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/fluxcd/cli-utils/pkg/object/unstructured_set.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/.travis.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/error_1_13.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/error_backward.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/join_unwrap_1_20.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/go-errors/errors/join_unwrap_backward.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/gofrs/flock/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/gofrs/flock/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/gofrs/flock/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/gofrs/flock/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/gofrs/flock/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/gofrs/flock/SECURITY.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/gofrs/flock/build.shis excluded by!**/vendor/**,!vendor/**vendor/github.com/gofrs/flock/flock.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/gofrs/flock/flock_others.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/gofrs/flock/flock_unix.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/gofrs/flock/flock_unix_fcntl.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/gofrs/flock/flock_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ianlancetaylor/demangle/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/ianlancetaylor/demangle/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/ianlancetaylor/demangle/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/ianlancetaylor/demangle/SECURITY.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/ianlancetaylor/demangle/ast.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ianlancetaylor/demangle/demangle.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/ianlancetaylor/demangle/rust.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/code.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/const_expr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/custom.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/decoder.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/element.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/encoder.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/export.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/function.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/global.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/header.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/import.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/limits.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/memory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/names.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/section.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/table.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/binary/value.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/ieee754/ieee754.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/leb128/leb128.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/wasm/counts.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/wasm/features.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/wasm/instruction.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/wasm/memory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/wasm/module.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wabin/wasm/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/.editorconfigis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/.gitattributesis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/.gitmodulesis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/Makefileis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/NOTICEis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/RATIONALE.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/api/features.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/api/wasm.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/builder.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/cache.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/codecov.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/checkpoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/close.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/compilationworkers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/experimental.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/features.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/importresolver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/listener.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/memory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/sys/dir.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/sys/errno.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/sys/error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/sys/file.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/sys/fs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/sys/oflag.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/sys/syscall_errno.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/sys/syscall_errno_notwindows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/sys/syscall_errno_unsupported.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/sys/syscall_errno_windows.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/sys/time.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/experimental/sys/unimplemented.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/fsconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1/args.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1/clock.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1/environ.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1/fs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1/poll.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1/proc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1/random.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1/sched.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1/sock.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/imports/wasi_snapshot_preview1/wasi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/descriptor/table.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/interpreter/compiler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/interpreter/format.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/interpreter/interpreter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/interpreter/operations.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/interpreter/signature.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/abi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/backend.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/compiler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/compiler_lower.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/go_call.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/abi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/abi_entry_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/abi_entry_amd64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/abi_entry_preamble.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/abi_go_call.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/cond.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/ext.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/instr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/instr_encoding.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/lower_constant.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/lower_mem.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/machine.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/machine_pro_epi_logue.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/machine_regalloc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/machine_vec.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/operands.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/reg.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/stack.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/abi.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/abi_entry_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/abi_entry_arm64.sis excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/abi_entry_preamble.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/abi_go_call.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/cond.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/instr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/instr_encoding.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/lower_constant.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/lower_instr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/lower_instr_operands.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/lower_mem.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/machine.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/machine_pro_epi_logue.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/machine_regalloc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/machine_relocation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/reg.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/unwind_stack.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/machine.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/regalloc/api.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/regalloc/reg.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/regalloc/regalloc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/regalloc/regset.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/vdef.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/call_engine.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/engine.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/engine_cache.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_other.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/frontend/frontend.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/frontend/lower.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/frontend/misc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/frontend/sort_id.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/hostmodule.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/isa_amd64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/isa_arm64.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/isa_other.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/memmove.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/module_engine.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/basic_block.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/basic_block_sort.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/builder.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/cmp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/funcref.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/instructions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/pass.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/pass_blk_layouts.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/pass_cfg.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/signature.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/ssa.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/type.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/ssa/vs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/debug_options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/exitcode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/offsetdata.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/perfmap.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/perfmap_disabled.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/perfmap_enabled.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/pool.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/ptr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/queue.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (36)
go.modpkg/helm/actions/auth.gopkg/helm/actions/auth_test.gopkg/helm/actions/config.gopkg/helm/actions/get_chart.gopkg/helm/actions/get_chart_test.gopkg/helm/actions/get_registry.gopkg/helm/actions/get_registry_test.gopkg/helm/actions/get_release.gopkg/helm/actions/get_release_test.gopkg/helm/actions/install_chart.gopkg/helm/actions/install_chart_test.gopkg/helm/actions/list_releases.gopkg/helm/actions/list_releases_test.gopkg/helm/actions/release_history.gopkg/helm/actions/release_history_test.gopkg/helm/actions/rollback_release.gopkg/helm/actions/rollback_release_test.gopkg/helm/actions/setup_test.gopkg/helm/actions/template.gopkg/helm/actions/template_test.gopkg/helm/actions/uninstall_release.gopkg/helm/actions/uninstall_release_test.gopkg/helm/actions/upgrade_release.gopkg/helm/actions/upgrade_release_test.gopkg/helm/chartproxy/proxy.gopkg/helm/chartproxy/proxy_test.gopkg/helm/chartproxy/repos.gopkg/helm/chartproxy/repos_test.gopkg/helm/chartverifier/chart_verifier.gopkg/helm/chartverifier/chart_verifier_test.gopkg/helm/handlers/client.gopkg/helm/handlers/handlerChartVerifier.gopkg/helm/handlers/handler_chartVerifier_test.gopkg/helm/handlers/handler_test.gopkg/helm/handlers/handlers.go
| gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect | ||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||
| gopkg.in/warnings.v0 v0.1.2 // indirect | ||
| helm.sh/helm/v3 v3.17.1 // indirect |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 1) Inspect go.mod around the referenced line
echo "=== go.mod lines 200-260 ==="
nl -ba go.mod | sed -n '200,260p'
# 2) Find all helm v3/v4 references in go.mod/go.sum
echo
echo "=== helm v3 references in go.mod/go.sum ==="
rg -n "helm\.sh/helm/v3" go.mod go.sum || true
echo
echo "=== helm v4 references in go.mod/go.sum ==="
rg -n "helm\.sh/helm/v4" go.mod go.sum || true
# 3) Search code for helm v3 imports/uses
echo
echo "=== Search for helm v3 imports in repo ==="
rg -n "helm\.sh/helm/v3" -S --hidden --glob '!.git/*' . || true
echo
echo "=== Search for helm v4 imports in repo ==="
rg -n "helm\.sh/helm/v4" -S --hidden --glob '!.git/*' . || true
# 4) Check which module pulls in helm/v3 by looking for helm v3 in go.mod dependency graph textually
# (no go command dependency on tools; best-effort: search go.mod for indirect requirements)
echo
echo "=== Any explicit require for helm v3 besides the snippet? (show full require blocks) ==="
awk '
BEGIN{inreq=0}
/^require \(/ {inreq=1; print ">> require block starts: " NR; next}
inreq && /^\)/ {inreq=0; print ">> require block ends: " NR; next}
inreq {print}
' go.mod | rg -n "helm\.sh/helm/v(3|4)" || trueRepository: openshift/console
Length of output: 151
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== go.mod lines 200-260 (with line numbers) ==="
awk 'NR>=200 && NR<=260 {printf "%d\t%s\n", NR, $0}' go.mod | sed -n '1,120p'
echo
echo "=== helm v3 references in go.mod/go.sum ==="
rg -n "helm\.sh/helm/v3" go.mod go.sum || true
echo
echo "=== helm v4 references in go.mod/go.sum ==="
rg -n "helm\.sh/helm/v4" go.mod go.sum || true
echo
echo "=== Search for helm v3 imports in repo ==="
rg -n "helm\.sh/helm/v3" -S --hidden --glob '!.git/*' . || true
echo
echo "=== Search for helm v4 imports in repo ==="
rg -n "helm\.sh/helm/v4" -S --hidden --glob '!.git/*' . || true
echo
echo "=== Any explicit require for helm v3/v4 besides the snippet? (require blocks) ==="
awk '
function printblock(bstart) {
for (i=bstart;i<=NR;i++) print arr[i]
}
BEGIN{inreq=0}
/^require \(/ {inreq=1}
inreq {arr[NR]=$0}
inreq && /^\)/ {inreq=0; # just continue; handled below
}
{ }
' go.mod > /tmp/go.mod.req.tmp
# Print lines in go.mod containing helm v3/v4 plus a small neighborhood
rg -n "helm\.sh/helm/v(3|4)" -n go.mod -C 3 || trueRepository: openshift/console
Length of output: 50373
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Inspect pkg/helm/handlers/handlers.go imports ==="
if [ -f pkg/helm/handlers/handlers.go ]; then
sed -n '1,120p' pkg/helm/handlers/handlers.go | nl -ba | sed -n '1,120p' 2>/dev/null || sed -n '1,120p' pkg/helm/handlers/handlers.go
else
echo "Missing: pkg/helm/handlers/handlers.go"
ls -R pkg/helm/handlers 2>/dev/null || true
fi
echo
echo "=== Non-vendor helm v3 imports ==="
rg -n "helm\.sh/helm/v3" --glob '!vendor/*' --glob '!.git/*' . || true
echo
echo "=== Non-vendor helm v4 imports ==="
rg -n "helm\.sh/helm/v4" --glob '!vendor/*' --glob '!.git/*' . || true
echo
echo "=== Non-vendor usage of chart-verifier (likely pulls helm v3) ==="
rg -n "redhat-certification/chart-verifier" --glob '!vendor/*' --glob '!.git/*' . || true
echo
echo "=== Non-vendor usage of helm-shaded chart-verifier packages (chartverifier) ==="
rg -n "chartverifier" --glob '!vendor/*' --glob '!.git/*' pkg . || trueRepository: openshift/console
Length of output: 19408
🌐 Web query:
OSV vulnerabilities for helm.sh/helm/v3 v3.17.1 (highest severity)
💡 Result:
As of June 12, 2026, version 3.17.1 of helm.sh/helm/v3 is affected by multiple vulnerabilities, including high-severity issues. The two most prominent vulnerabilities identified for this specific version are: 1. CVE-2025-32386 (GHSA-4hfp-h4cw-hj8p): A specially crafted chart archive can cause Out-Of-Memory (OOM) termination. A chart can be designed to expand to a significantly larger size when uncompressed, exhausting available memory during loading [1][2][3]. 2. CVE-2025-32387 (GHSA-5xqw-8hwv-wg92): A specially crafted JSON Schema within a chart can cause a stack overflow. Deeply nested chains of references in the schema can exceed the parser's stack size limit [4][5][6]. Both of these vulnerabilities have a severity rating of 6.5 (Medium, according to CVSS v3.1) and were resolved in Helm v3.17.3 [4][5][1][6][3]. Users running v3.17.1 are advised to upgrade to a patched version to mitigate these risks [6][3]. Additionally, version 3.17.1 is affected by CVE-2025-53547 (GHSA-557j-xg8c-q2mm), which involves potential local code execution when updating dependencies if a malicious Chart.lock symlink is present; this was resolved in Helm v3.17.4 and v3.18.4 [7].
Citations:
- 1: https://osv.dev/vulnerability/CVE-2025-32386
- 2: https://osv.dev/vulnerability/GHSA-4hfp-h4cw-hj8p
- 3: GHSA-4hfp-h4cw-hj8p
- 4: https://osv.dev/vulnerability/CVE-2025-32387
- 5: https://osv.dev/vulnerability/GHSA-5xqw-8hwv-wg92
- 6: GHSA-5xqw-8hwv-wg92
- 7: GHSA-557j-xg8c-q2mm
🌐 Web query:
osv.dev helm.sh/helm/v3 3.17.1 advisory
💡 Result:
Helm version 3.17.1 is affected by several security vulnerabilities that have been addressed in subsequent releases. Users are advised to upgrade to a newer version to mitigate these risks. Key vulnerabilities affecting Helm 3.17.1 include: 1. Stack Overflow via JSON Schema (CVE-2025-32387): A vulnerability exists where a specially crafted JSON Schema within a chart can lead to parser recursion, exceeding stack size limits and causing a stack overflow [1][2][3]. This was resolved in Helm v3.17.3 [1][2][3]. 2. Out-of-Memory (OOM) Termination via Chart Archive (CVE-2025-32386): Helm is vulnerable to OOM termination if a specially crafted chart archive is loaded, where the uncompressed size is significantly larger than the compressed size [4][5][6]. This issue was resolved in Helm v3.17.3 [4][5][6]. 3. Local Code Execution during Dependency Updates (CVE-2025-53547): A vulnerability involving malicious Chart.yaml content and symbolic links in Chart.lock files can lead to local code execution during dependency updates [7][8]. This was resolved in Helm v3.17.4 and v3.18.4 [7][8]. Given these vulnerabilities, upgrading to the latest available version of Helm is recommended to ensure all security patches are applied [7][2][5][8]. You can verify vulnerability statuses and associated advisories through the official OSV.dev database or the Helm GitHub repository security advisories page [1][9][7][2][5][8].
Citations:
- 1: https://osv.dev/vulnerability/CVE-2025-32387
- 2: GHSA-5xqw-8hwv-wg92
- 3: https://nvd.nist.gov/vuln/detail/CVE-2025-32387
- 4: https://osv.dev/CVE-2025-32386
- 5: GHSA-4hfp-h4cw-hj8p
- 6: https://nvd.nist.gov/vuln/detail/CVE-2025-32386
- 7: https://osv.dev/vulnerability/GHSA-557j-xg8c-q2mm
- 8: GHSA-557j-xg8c-q2mm
- 9: https://osv.dev/vulnerability/GHSA-4hfp-h4cw-hj8p
Remove or patch the leftover Helm v3 module
go.mod still pins helm.sh/helm/v3 v3.17.1 // indirect, and this version is pulled into the vendored build via github.com/redhat-certification/chart-verifier (while the console’s own Helm handler code imports Helm v4). OSV reports multiple vulnerabilities for v3.17.1 (notably CVE-2025-32386, CVE-2025-32387, CVE-2025-53547), with fixes in v3.17.3/v3.17.4/v3.18.4. Update the transitive Helm v3 dependency by bumping the chart-verifier dependency (or pinning helm.sh/helm/v3 to the patched version via replace) so the module graph/vendor no longer uses v3.17.1.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm
(GO-2025-3601)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm
(GO-2025-3602)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm
(GO-2025-3802)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm
(GO-2025-3887)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm May Panic Due To Incorrect YAML Content in helm.sh/helm
(GO-2025-3888)
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm vulnerable to Code Injection through malicious chart.yaml content
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm May Panic Due To Incorrect YAML Content
[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Chart extraction output directory collapse via Chart.yaml name dot-segment
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 230, The go.mod currently pulls helm.sh/helm/v3 v3.17.1
(transitively via github.com/redhat-certification/chart-verifier) which is
vulnerable; update the dependency graph by either (A) bumping
github.com/redhat-certification/chart-verifier to a newer version that itself
depends on a patched helm v3 (so the transitive helm.sh/helm/v3 resolves to >=
v3.17.3/v3.18.4), or (B) add a go.mod replace directive to pin helm.sh/helm/v3
to a patched release (e.g., v3.17.3 or v3.18.4) to override the transitive
v3.17.1; locate references to github.com/redhat-certification/chart-verifier and
helm.sh/helm/v3 in go.mod and update the chart-verifier module version or add
the replace line, then run go mod tidy && go mod vendor (if vendored) and verify
the module graph no longer contains helm.sh/helm/v3 v3.17.1.
Sources: Coding guidelines, Linters/SAST tools
Contributor
Author
There was a problem hiding this comment.
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
gh issue view 623 --repo redhat-certification/chart-verifier --json number,title,state,body,createdAt,updatedAt,comments | jq '{number, title, state, createdAt, updatedAt, bodyPreview: .body[:500], commentCount: (.comments | length), lastComments: (.comments[-3:] | map({author: .author.login, body: .body[:300]}) )}'Length of output: 988
@sowmya-sl Thanks for filing redhat-certification/chart-verifier#623 to track the upstream upgrade. Since that issue is freshly opened and has no timeline yet, the transitive helm.sh/helm/v3 v3.17.1 will remain in the module graph for some time.
As a short-term mitigation until chart-verifier upgrades, consider adding a replace directive in go.mod to pin the transitive v3 dependency to a patched release:
// Temporary: pin transitive helm v3 (via chart-verifier) to patched release until
// redhat-certification/chart-verifier#623 is resolved.
replace helm.sh/helm/v3 => helm.sh/helm/v3 v3.17.4Note:
v3.17.4fixes all currently known HIGH CVEs (CVE-2025-32386, CVE-2025-32387, CVE-2025-53547, and the additional ones flagged by OSV). You would then rungo mod tidy && go mod vendorto apply it. Once chart-verifier ships a version that pulls in a patched helm v3 (or upgrades to v4), thereplacecan be removed.
webbnh
reviewed
Jun 12, 2026
webbnh
left a comment
webbnh
left a comment
Contributor
There was a problem hiding this comment.
I don't see any major problems beyond what CodeRabbit already called out. I suggested an alternative labeling for releasecommon, and I raised a concern about the charts v2 dependency (but we can defer that to round 2). Otherwise, I just flagged a few nits.
Comment on lines
+9
to
+10
| chart "helm.sh/helm/v4/pkg/chart/v2" | ||
| "helm.sh/helm/v4/pkg/chart/v2/loader" |
Contributor
There was a problem hiding this comment.
This raises a red flag: the reason for upgrading to the v4 SDK is to get support for chart-v3 features, so simply replacing helm.sh/helm/v3/pkg/chart with helm.sh/helm/v4/pkg/chart/v2 may not be what we want (although, it might be OK as a first step to get to v4).
| continue | ||
| } | ||
| // Match line like " helm.sh/helm/v3 v3.18.5" or " helm.sh/helm/v3 v3.18.5 // indirect". | ||
| // Match line like " helm.sh/helm/v4 v4.1.1 " // indirect". |
Contributor
There was a problem hiding this comment.
While it's OK to update this from v3 to v4, there are supposed to be two options (a direct and an // indirect, enclosed in quotes (to mark the blanks) with an or between them 🙂).
Comment on lines
+30
to
+31
| includeCrds := true | ||
| client.SkipCRDs = !includeCrds |
Contributor
There was a problem hiding this comment.
Is there any reason to instantiate includeCrds, or should we just set client.SkipCRDs to false?
(There's a similar question about validate.)
Comment on lines
+28
to
+29
| client.DryRun = true | ||
| client.DryRunStrategy = action.DryRunNone |
Contributor
There was a problem hiding this comment.
CodeRabbit already mentioned this, but the new DryRunStrategy = action.DryRunNone doesn't look equivalent to the old DryRun = true.
Contributor
Author
There was a problem hiding this comment.
Its a a replacement of Helmv3's DryRun=true and ClientOnly=true
Comment on lines
+80
to
+82
| result, err := client.Run(ch, vals) | ||
| if err != nil { | ||
| return emptyResponse, err | ||
| return "", err |
Contributor
There was a problem hiding this comment.
Some lines in this function (e.g., new line 77) return emptyResponse, while others (e.g., new line 61) return an empty string literal...it would be good if the code were consistent.
Comment on lines
+10
to
+11
| releasecommon "helm.sh/helm/v4/pkg/release" | ||
| release "helm.sh/helm/v4/pkg/release/v1" |
Contributor
There was a problem hiding this comment.
This is OK, but I think the code would have better longevity if you labeled helm.sh/helm/v4/pkg/release/v1 as release_v1 (or releaseV1) so that helm.sh/helm/v4/pkg/release could remain plain release.
Contributor
Author
There was a problem hiding this comment.
I checked the changes, most of the release is now in release/v1 except one function which went to release in v4.
https://pkg.go.dev/helm.sh/helm/v3@v3.20.1/pkg/release
https://pkg.go.dev/helm.sh/helm/v4@v4.1.4/pkg/release/v1
Changing release to release_v1 will add a lot more code changes just changing the names.
Contributor
There was a problem hiding this comment.
Changing release to release_v1 will add a lot more code changes just changing the names.
So, that means, at best, we're relying on compatibility code for our release support, and at worse we have a bunch of accrued technical debt.
I suppose, in terms of getting to Helm v4 quickly, and doing it via small, incremental change, keeping release referring to release/v1 is expedient, but it smells like we're papering over something which might become a problem. At least if we were to use the release_v1 label, we would be making it clear where we are "behind".
When you say it will add a lot more code changes, how much of that is to code that you are already changing?
Also, among other things that Cursor has to say about this topic, it says,
For direct field access on chart-v2 releases, the migration is mostly import rewrites plus handling
Releaserreturns from action APIs. For library code that should survive future chart API versions, preferrelease.NewAccessor()over hard-coding*releasev1.Release.
If you follow that advice, then I think you'll be removing references to release/v1, and then you'll prefer to have release refer to v4/pkg/release.
Also, apparently there is a v4/pkg/release/common...on that basis, I would recommend against using the releasecommon label to refer to any other packge (like v4/pkg/release).
Contributor
Author
There was a problem hiding this comment.
changed release/v1 to be imported as releaseV1
Should I change releasecomon also?
| } | ||
|
|
||
| ch := resp.Release.Chart | ||
| ch := resp.Release.(*release.Release).Chart |
Contributor
There was a problem hiding this comment.
No guard is required or appropriate here (nor at line new line 42)?
Contributor
|
/test all |
Contributor
|
FWIW, the |
- Rename release import alias from `release` to `releaseV1` for clarity
since the v4 SDK splits release types across release/v1 and release/common
- Add type assertions for Helm v4 Run() results which now return interface{}
- Replace removed Configuration.Log and chartutil.DefaultCapabilities with
v4 equivalents (structured logging, common.DefaultCapabilities)
- Fix template.go: use DryRunClient strategy, correct DependencyUpdate and
SkipSchemaValidation flags
- Update all tests to use rcommon.StatusDeployed and releaseV1 types
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (5)
pkg/helm/actions/upgrade_release.go (1)
58-106:⚠️ Potential issue | 🟠 Major | ⚡ Quick winTLS temp files are not guaranteed to be cleaned on error paths.
Both sync and async upgrade flows can return before cleanup is scheduled/executed, leaving auth temp files on disk.
Proposed fix
@@ - var tlsFiles []*os.File + var tlsFiles []*os.File + defer func() { + if !fileCleanUp { + return + } + for _, f := range tlsFiles { + _ = os.Remove(f.Name()) + } + }() @@ - // remove all the tls related files created by this process - defer func() { - if fileCleanUp == false { - return - } - for _, f := range tlsFiles { - os.Remove(f.Name()) - } - }() return rel, nilFor
UpgradeReleaseAsync, keep goroutine cleanup, but also add an outer fallback cleanup for pre-goroutine failures (e.g., with astartedflag) so early returns are covered.Also applies to: 129-136, 175-223, 244-251
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helm/actions/upgrade_release.go` around lines 58 - 106, TLS temporary files created by setUpAuthentication and setUpAuthenticationProject calls are not guaranteed to be cleaned up when errors occur on early return paths, leaving auth temp files on disk. In the UpgradeReleaseAsync function, implement a fallback cleanup mechanism for the tlsFiles variable that covers pre-goroutine failures by adding a started flag and ensuring cleanup is executed even when early returns happen before the cleanup goroutine is launched. This fix should be applied at the anchor location in upgrade_release.go (58-106 where tlsFiles are initially created and returned on error paths) and ensure the cleanup logic at the sibling locations (129-136, 175-223, 244-251) is also properly protected by the fallback mechanism so that all code paths that could return early have cleanup covered.pkg/helm/actions/rollback_release_test.go (1)
65-70:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRollback tests have unsafe/missing error assertions.
Line 66 can dereference
tt.errwhen it is nil (success case), and Line 104-107 doesn’t fail when an expected error is missing.Proposed fix
@@ - r, err := RollbackRelease(tt.release.Name, tt.rollbackTo, actionConfig) - if err != nil && err.Error() != tt.err.Error() { - t.Error(err) - } - if err != nil && err.Error() == tt.err.Error() { - return - } + r, err := RollbackRelease(tt.release.Name, tt.rollbackTo, actionConfig) + if tt.err != nil { + require.ErrorIs(t, err, tt.err) + return + } + require.NoError(t, err) @@ - _, err := RollbackRelease(tt.releaseName, tt.rollbackTo, actionConfig) - if err != nil && err.Error() != tt.err.Error() { - t.Error(err) - } + _, err := RollbackRelease(tt.releaseName, tt.rollbackTo, actionConfig) + require.ErrorIs(t, err, tt.err)Also applies to: 104-107
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helm/actions/rollback_release_test.go` around lines 65 - 70, The test has unsafe error assertions that can cause nil pointer dereferences and fail to catch missing expected errors. In pkg/helm/actions/rollback_release_test.go at lines 65-70, before comparing error messages with `err.Error() != tt.err.Error()`, first verify that both `err` and `tt.err` are non-nil to avoid dereferencing a nil pointer in success cases. Additionally, at lines 104-107 in the same file, add proper test failure logic to ensure the test fails when an expected error (tt.err) is not nil but the actual error is nil, indicating the expected error did not occur as anticipated.pkg/helm/actions/upgrade_release_test.go (1)
9-10:⚠️ Potential issue | 🔴 CriticalDuplicate
timeimport causes compile failure.Lines 9 and 25 both import
"time": line 9 unaliased, line 25 ashelmTime. Go forbids duplicate import paths in a single import block, even with different aliases. Remove the aliased import on line 25 and replace all 6 occurrences ofhelmTime.Time{}withtime.Time{}(at lines 121, 224, 352, 466, 584, 670).Proposed fix
import ( "fmt" "io" "os" "strings" "testing" "time" - - "github.com/stretchr/testify/require" + "github.com/stretchr/testify/require"Then replace all
helmTime.Time{}withtime.Time{}at lines 121, 224, 352, 466, 584, 670.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helm/actions/upgrade_release_test.go` around lines 9 - 10, Remove the duplicate `time` import by deleting the aliased import statement that imports `"time"` as `helmTime` from the import block. Then locate all 6 occurrences where `helmTime.Time{}` is used throughout the file and replace each one with `time.Time{}` to use the unaliased `time` package import that remains at the top of the file.pkg/helm/actions/install_chart_test.go (1)
106-116:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSuccess-path assertions are currently unreachable in
TestInstallChart.Line 106 checks
tt.releaseName == "valid chart path", but the table values are"myrelease"and"invalid chart path"(Lines 47 and 70). So the success assertions (including the Helm v4 status assertion on Line 110) never run.Suggested fix
- if tt.releaseName == "valid chart path" { + if tt.releaseName == "myrelease" { require.NoError(t, err) require.Equal(t, "test", rel.Name) require.Equal(t, "test-namespace", rel.Namespace) require.Equal(t, rcommon.StatusDeployed, rel.Info.Status) require.Equal(t, tt.chartName, rel.Chart.Metadata.Name) require.Equal(t, tt.chartVersion, rel.Chart.Metadata.Version) require.Equal(t, tt.chartPath, rel.Chart.Metadata.Annotations["chart_url"]) } else if tt.releaseName == "invalid chart path" { require.Error(t, err) }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helm/actions/install_chart_test.go` around lines 106 - 116, The condition in the TestInstallChart test function is checking for a releaseName value of "valid chart path" that does not exist in the test table data. Update the condition at line 106 to check for the actual releaseName value from the first test case in the table (which represents the success case) instead of "valid chart path". This will make the success-path assertions in the subsequent block reachable so they execute properly during the test.pkg/helm/actions/install_chart.go (1)
159-167:⚠️ Potential issue | 🟠 Major | ⚡ Quick winTLS auth temp-file cleanup is deferred too late in both install and template flows.
Both functions register cleanup near the end, but return on earlier errors; this can leave cert/key temp files on disk after failure paths.
pkg/helm/actions/install_chart.go#L159-L167: move the TLS cleanupdeferto immediately aftertlsFilesinitialization (or right after auth setup) so it runs for all return paths, including the new type-assertion failure.pkg/helm/actions/template.go#L39-L84: apply the same pattern so early errors (auth setup, chart locate/load, run/type assertion) still trigger file cleanup.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/helm/actions/install_chart.go` around lines 159 - 167, The TLS cleanup defer statement is registered too late in the error handling flow, causing temporary certificate and key files to leak when early errors occur. In pkg/helm/actions/install_chart.go (lines 159-167), move the defer cleanup statement that handles tlsFiles to immediately after the tlsFiles variable is initialized or after the authentication setup completes, ensuring it runs for all return paths including the type-assertion failure for the Release object. Apply the identical pattern in pkg/helm/actions/template.go (lines 39-84) by moving its TLS cleanup defer to the earliest point after tlsFiles setup so that early errors during auth configuration, chart location, chart loading, command execution, and type assertion all trigger the proper file cleanup before returning.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/helm/actions/install_chart.go`:
- Around line 250-253: The async helm install error handling block ignores error
returns from both createSecret and Delete operations, which can hide failures
and leave stale secrets. Capture and handle the error returned from the
createSecret call when creating the tracking secret with value 1, and also
capture and handle the error returned from the Delete operation on
coreClient.Secrets. For both cases, log any errors that occur rather than
silently dropping them, ensuring proper error reporting for the async
installation failure flow.
In `@pkg/helm/actions/uninstall_release_test.go`:
- Around line 50-55: The test is missing explicit assertions on the error
outcomes. In the success case around the UninstallRelease call (lines 50-55),
add an explicit check that err is nil to confirm the operation succeeded without
errors. In the error case around lines 83-90, add an explicit check that err is
not nil to confirm the expected error was actually returned. Both test paths
must fail immediately when their expected error condition is not met, rather
than silently passing when the err value is not validated.
---
Outside diff comments:
In `@pkg/helm/actions/install_chart_test.go`:
- Around line 106-116: The condition in the TestInstallChart test function is
checking for a releaseName value of "valid chart path" that does not exist in
the test table data. Update the condition at line 106 to check for the actual
releaseName value from the first test case in the table (which represents the
success case) instead of "valid chart path". This will make the success-path
assertions in the subsequent block reachable so they execute properly during the
test.
In `@pkg/helm/actions/install_chart.go`:
- Around line 159-167: The TLS cleanup defer statement is registered too late in
the error handling flow, causing temporary certificate and key files to leak
when early errors occur. In pkg/helm/actions/install_chart.go (lines 159-167),
move the defer cleanup statement that handles tlsFiles to immediately after the
tlsFiles variable is initialized or after the authentication setup completes,
ensuring it runs for all return paths including the type-assertion failure for
the Release object. Apply the identical pattern in pkg/helm/actions/template.go
(lines 39-84) by moving its TLS cleanup defer to the earliest point after
tlsFiles setup so that early errors during auth configuration, chart location,
chart loading, command execution, and type assertion all trigger the proper file
cleanup before returning.
In `@pkg/helm/actions/rollback_release_test.go`:
- Around line 65-70: The test has unsafe error assertions that can cause nil
pointer dereferences and fail to catch missing expected errors. In
pkg/helm/actions/rollback_release_test.go at lines 65-70, before comparing error
messages with `err.Error() != tt.err.Error()`, first verify that both `err` and
`tt.err` are non-nil to avoid dereferencing a nil pointer in success cases.
Additionally, at lines 104-107 in the same file, add proper test failure logic
to ensure the test fails when an expected error (tt.err) is not nil but the
actual error is nil, indicating the expected error did not occur as anticipated.
In `@pkg/helm/actions/upgrade_release_test.go`:
- Around line 9-10: Remove the duplicate `time` import by deleting the aliased
import statement that imports `"time"` as `helmTime` from the import block. Then
locate all 6 occurrences where `helmTime.Time{}` is used throughout the file and
replace each one with `time.Time{}` to use the unaliased `time` package import
that remains at the top of the file.
In `@pkg/helm/actions/upgrade_release.go`:
- Around line 58-106: TLS temporary files created by setUpAuthentication and
setUpAuthenticationProject calls are not guaranteed to be cleaned up when errors
occur on early return paths, leaving auth temp files on disk. In the
UpgradeReleaseAsync function, implement a fallback cleanup mechanism for the
tlsFiles variable that covers pre-goroutine failures by adding a started flag
and ensuring cleanup is executed even when early returns happen before the
cleanup goroutine is launched. This fix should be applied at the anchor location
in upgrade_release.go (58-106 where tlsFiles are initially created and returned
on error paths) and ensure the cleanup logic at the sibling locations (129-136,
175-223, 244-251) is also properly protected by the fallback mechanism so that
all code paths that could return early have cleanup covered.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 42ac90f1-9941-4dce-abb3-8365c1117ef5
📒 Files selected for processing (22)
pkg/helm/actions/get_chart_test.gopkg/helm/actions/get_registry_test.gopkg/helm/actions/get_release.gopkg/helm/actions/get_release_test.gopkg/helm/actions/install_chart.gopkg/helm/actions/install_chart_test.gopkg/helm/actions/list_releases.gopkg/helm/actions/list_releases_test.gopkg/helm/actions/release_history.gopkg/helm/actions/release_history_test.gopkg/helm/actions/rollback_release.gopkg/helm/actions/rollback_release_test.gopkg/helm/actions/setup_test.gopkg/helm/actions/template.gopkg/helm/actions/template_test.gopkg/helm/actions/uninstall_release.gopkg/helm/actions/uninstall_release_test.gopkg/helm/actions/upgrade_release.gopkg/helm/actions/upgrade_release_test.gopkg/helm/chartverifier/chart_verifier_test.gopkg/helm/handlers/handler_test.gopkg/helm/handlers/handlers.go
🚧 Files skipped from review as they are similar to previous changes (6)
- pkg/helm/chartverifier/chart_verifier_test.go
- pkg/helm/actions/uninstall_release.go
- pkg/helm/handlers/handlers.go
- pkg/helm/actions/setup_test.go
- pkg/helm/actions/list_releases.go
- pkg/helm/actions/release_history_test.go
Comment on lines
250
to
253
| klog.Errorf("Async helm install failed for %s/%s: %v", ns, name, err) | ||
| createSecret(ns, name, 1, coreClient, err) | ||
| time.Sleep(15 * time.Second) | ||
| coreClient.Secrets(ns).Delete(context.TODO(), name, v1.DeleteOptions{}) |
Contributor
There was a problem hiding this comment.
Handle async secret lifecycle errors instead of dropping them.
Line 251 ignores createSecret(...) errors and Line 253 ignores Delete(...) errors. That can hide failure-state reporting and leave stale tracking secrets behind.
As per coding guidelines, **/*.go: Go security (prodsec-skills): Never ignore error returns.
Suggested fix
import (
"context"
"fmt"
"net/url"
"os"
"regexp"
"strings"
"time"
"github.com/openshift/api/helm/v1beta1"
"github.com/openshift/console/pkg/helm/metrics"
"helm.sh/helm/v4/pkg/action"
chart "helm.sh/helm/v4/pkg/chart/v2"
"helm.sh/helm/v4/pkg/chart/v2/loader"
"helm.sh/helm/v4/pkg/kube"
releaseV1 "helm.sh/helm/v4/pkg/release/v1"
kv1 "k8s.io/api/core/v1"
+ apierrors "k8s.io/apimachinery/pkg/api/errors"
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/client-go/dynamic"
corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
"k8s.io/klog/v2"
)
@@
} else {
klog.Errorf("Async helm install failed for %s/%s: %v", ns, name, err)
- createSecret(ns, name, 1, coreClient, err)
+ if secretErr := createSecret(ns, name, 1, coreClient, err); secretErr != nil {
+ klog.Errorf("Failed to create error-tracking secret for %s/%s: %v", ns, name, secretErr)
+ }
time.Sleep(15 * time.Second)
- coreClient.Secrets(ns).Delete(context.TODO(), name, v1.DeleteOptions{})
+ if delErr := coreClient.Secrets(ns).Delete(context.TODO(), name, v1.DeleteOptions{}); delErr != nil && !apierrors.IsNotFound(delErr) {
+ klog.Errorf("Failed to delete error-tracking secret for %s/%s: %v", ns, name, delErr)
+ }
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| klog.Errorf("Async helm install failed for %s/%s: %v", ns, name, err) | |
| createSecret(ns, name, 1, coreClient, err) | |
| time.Sleep(15 * time.Second) | |
| coreClient.Secrets(ns).Delete(context.TODO(), name, v1.DeleteOptions{}) | |
| klog.Errorf("Async helm install failed for %s/%s: %v", ns, name, err) | |
| if secretErr := createSecret(ns, name, 1, coreClient, err); secretErr != nil { | |
| klog.Errorf("Failed to create error-tracking secret for %s/%s: %v", ns, name, secretErr) | |
| } | |
| time.Sleep(15 * time.Second) | |
| if delErr := coreClient.Secrets(ns).Delete(context.TODO(), name, v1.DeleteOptions{}); delErr != nil && !apierrors.IsNotFound(delErr) { | |
| klog.Errorf("Failed to delete error-tracking secret for %s/%s: %v", ns, name, delErr) | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/helm/actions/install_chart.go` around lines 250 - 253, The async helm
install error handling block ignores error returns from both createSecret and
Delete operations, which can hide failures and leave stale secrets. Capture and
handle the error returned from the createSecret call when creating the tracking
secret with value 1, and also capture and handle the error returned from the
Delete operation on coreClient.Secrets. For both cases, log any errors that
occur rather than silently dropping them, ensuring proper error reporting for
the async installation failure flow.
Source: Coding guidelines
Comment on lines
50
to
55
| resp, err := UninstallRelease(tt.release.Name, actionConfig) | ||
| if resp != nil && resp.Release.Info.Status != release.StatusUninstalled { | ||
| t.Error(errors.New("Release status is not uninstalled")) | ||
| if resp != nil { | ||
| if rel, ok := resp.Release.(*releaseV1.Release); ok && rel.Info.Status != rcommon.StatusUninstalled { | ||
| t.Error(errors.New("Release status is not uninstalled")) | ||
| } | ||
| } |
Contributor
There was a problem hiding this comment.
Assert expected uninstall error outcomes explicitly.
Line 50 assigns err but the success case never asserts err == nil, and Line 83’s invalid-case logic doesn’t fail when the expected error is absent. Both tests can pass on broken behavior.
Proposed fix
@@
- resp, err := UninstallRelease(tt.release.Name, actionConfig)
- if resp != nil {
- if rel, ok := resp.Release.(*releaseV1.Release); ok && rel.Info.Status != rcommon.StatusUninstalled {
- t.Error(errors.New("Release status is not uninstalled"))
- }
- }
+ resp, err := UninstallRelease(tt.release.Name, actionConfig)
+ require.NoError(t, err)
+ require.NotNil(t, resp)
+ rel, ok := resp.Release.(*releaseV1.Release)
+ require.True(t, ok)
+ require.Equal(t, rcommon.StatusUninstalled, rel.Info.Status)
@@
- resp, err := UninstallRelease(tt.release.Name, actionConfig)
- if err != nil && err.Error() != tt.err.Error() {
- t.Error(err)
- }
- if resp != nil {
- if rel, ok := resp.Release.(*releaseV1.Release); ok && rel.Info.Status != rcommon.StatusUninstalled {
- t.Error(errors.New("Release status is not uninstalled"))
- }
- }
+ resp, err := UninstallRelease(tt.release.Name, actionConfig)
+ require.ErrorIs(t, err, tt.err)
+ require.Nil(t, resp)Also applies to: 83-90
🧰 Tools
🪛 golangci-lint (2.12.2)
[error] 50-50: ineffectual assignment to err
(ineffassign)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/helm/actions/uninstall_release_test.go` around lines 50 - 55, The test is
missing explicit assertions on the error outcomes. In the success case around
the UninstallRelease call (lines 50-55), add an explicit check that err is nil
to confirm the operation succeeded without errors. In the error case around
lines 83-90, add an explicit check that err is not nil to confirm the expected
error was actually returned. Both test paths must fail immediately when their
expected error condition is not met, rather than silently passing when the err
value is not validated.
Source: Linters/SAST tools
…trategy Helm v4 changed two critical defaults from v3: - NewInstall now defaults ServerSideApply=true (v3 used client-side apply) - WaitStrategy is now a required field (v3 had Wait bool defaulting to false) Disable ServerSideApply and set WaitStrategy to LegacyStrategy on all install and upgrade paths to preserve v3 behavior and prevent silent failures in async goroutines. Co-authored-by: Cursor <cursoragent@cursor.com>
sowmya-sl
force-pushed
the
upgrade-helm-in-console
branch
from
2651c14 to
c88249f
Compare
Contributor
|
@sowmya-sl: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR has Helm 3 to Helm 4 upgrade for console. The changes include the Helm API import changes from v3 to v4, adding Helm 4 to vendor folder and fixing the changed interfaces in Helm 4 to work with the current code.
Summary by CodeRabbit