Merge branch 'databus23:master' into structured-diff-list

Author: demolitionmode

.github/workflows/ci.yaml

@@ -13,8 +13,8 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: "go.mod"
 
@@ -40,7 +40,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
         shell: [default]
         experimental: [false]
-        helm-version: [v3.18.6, v3.21.1, v4.2.1]
+        helm-version: [v3.18.6, v3.21.3, v4.2.3]
         include:
           - os: windows-latest
             shell: wsl
@@ -58,29 +58,29 @@ jobs:
           - os: windows-latest
             shell: wsl
             experimental: false
-            helm-version: v3.21.1
+            helm-version: v3.21.3
           - os: windows-latest
             shell: cygwin
             experimental: false
-            helm-version: v3.21.1
+            helm-version: v3.21.3
           - os: ubuntu-latest
             container: alpine
             shell: sh
             experimental: false
-            helm-version: v3.21.1
+            helm-version: v3.21.3
           - os: windows-latest
             shell: wsl
             experimental: false
-            helm-version: v4.2.1
+            helm-version: v4.2.3
           - os: windows-latest
             shell: cygwin
             experimental: false
-            helm-version: v4.2.1
+            helm-version: v4.2.3
           - os: ubuntu-latest
             container: alpine
             shell: sh
             experimental: false
-            helm-version: v4.2.1
+            helm-version: v4.2.3
 
     steps:
       - name: Disable autocrlf
@@ -89,7 +89,7 @@ jobs:
           git config --global core.autocrlf false
           git config --global core.eol lf
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Helm
         uses: azure/setup-helm@v5
@@ -119,14 +119,14 @@ jobs:
           # That's why we cover only 2 Helm minor versions in this matrix.
           # See https://github.com/helmfile/helmfile/pull/286#issuecomment-1250161182 for more context.
           - helm-version: v3.18.6
-          - helm-version: v3.21.1
-          - helm-version: v4.2.1
+          - helm-version: v3.21.3
+          - helm-version: v4.2.3
     steps:
       - uses: helm/kind-action@v1.14.0
         with:
           cluster_name: kind
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Helm
         uses: azure/setup-helm@v5

.github/workflows/lint-sh.yaml

@@ -15,7 +15,7 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[ci skip]')"
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: luizm/action-sh-checker@v0.10.0
         with:
           sh_checker_exclude: 'scripts'

.github/workflows/lint.yaml

@@ -15,8 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
       - uses: golangci/golangci-lint-action@v9

.github/workflows/release.yaml

@@ -37,12 +37,12 @@ jobs:
         run: echo "flags=--snapshot --skip=sign" >> $GITHUB_ENV
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       -
         name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
       -
@@ -135,7 +135,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       -
         name: Test provenance signing with disposable key
         run: |

cmd/helm.go

@@ -412,7 +412,7 @@ func (d *diffCmd) template(isUpgrade bool) ([]byte, error) {
 		subcmd = "template"
 
 		filter = func(s []byte) []byte {
-			return s
+			return stripOCIPullProgress(s)
 		}
 	}
 
@@ -494,6 +494,36 @@ func extractManifestFromHelmUpgradeDryRunOutput(s []byte, noHooks bool) []byte {
 	return r
 }
 
+// ociPullProgressRE matches Helm's OCI chart pull progress lines that Helm writes
+// to stdout before the rendered manifests when the chart, or one of its subcharts,
+// is pulled from an OCI registry.
+//
+// The lines reported in the wild are "Pulled: ..." and "Digest: ...";
+// "Pulling: ..." is matched defensively too.
+//
+// These lines are emitted at the start of a line and are not valid Kubernetes
+// manifests, so they are safe to strip. Top-level manifest keys are
+// apiVersion/kind/metadata/spec and never "Pulled", "Digest" or "Pulling";
+// any homonymous keys inside a manifest are indented and therefore not matched.
+//
+// See https://github.com/databus23/helm-diff/issues/1040
+var ociPullProgressRE = regexp.MustCompile(`(?m)^(?:Pulled|Digest|Pulling):[^\n]*\n?`)
+
+// stripOCIPullProgress removes Helm's OCI chart pull progress output that leaks
+// into the rendered manifest buffer when the chart (or a subchart) is pulled
+// from an OCI registry.
+//
+// Without this, the progress lines (e.g. "Pulled: ...", "Digest: ...") are
+// parsed as a YAML document lacking a Kind and break the downstream three-way
+// merge / kubeclient.Build():
+//
+//	unable to decode "": Object 'Kind' is missing in '{"Digest":"...","Pulled":"..."}'
+//
+// See https://github.com/databus23/helm-diff/issues/1040
+func stripOCIPullProgress(s []byte) []byte {
+	return ociPullProgressRE.ReplaceAll(s, []byte(""))
+}
+
 // serverSideFlags returns the --server-side flag(s) to forward to helm.
 //
 // The flag is Helm v4 only:

cmd/helm_test.go

@@ -8,6 +8,78 @@ import (
 	"github.com/google/go-cmp/cmp"
 )
 
+func TestStripOCIPullProgress(t *testing.T) {
+	manifest := `---
+# Source: karpenter/templates/cm.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: karpenter
+  namespace: karpenter
+data:
+  Pulled: preserved
+  Digest: preserved
+---
+# Source: karpenter/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: karpenter
+  namespace: karpenter
+`
+
+	cases := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{
+			name: "strips OCI pull progress prepended to manifests",
+			in: "Pulled: public.ecr.aws/karpenter/karpenter:1.9.0\n" +
+				"Digest: sha256:8e3952caafd208cb888fbf97467cd04a4a024a3fba64c84af73039040cc6a371\n" +
+				manifest,
+			want: manifest,
+		},
+		{
+			name: "strips Pulling/Pulled/Digest progress lines",
+			in: "Pulling: public.ecr.aws/karpenter/karpenter:1.9.0\n" +
+				"Pulled: public.ecr.aws/karpenter/karpenter:1.9.0\n" +
+				"Digest: sha256:abc123\n" +
+				manifest,
+			want: manifest,
+		},
+		{
+			name: "does not modify output without OCI progress",
+			in:   manifest,
+			want: manifest,
+		},
+		{
+			name: "preserves indented Pulled/Digest keys inside manifests",
+			in:   manifest,
+			want: manifest,
+		},
+		{
+			name: "strips OCI progress even with no trailing manifests",
+			in:   "Pulled: registry.example.com/chart:1.0.0\nDigest: sha256:deadbeef\n",
+			want: "",
+		},
+		{
+			name: "returns empty for empty input",
+			in:   "",
+			want: "",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := stripOCIPullProgress([]byte(tc.in))
+			if d := cmp.Diff(tc.want, string(got)); d != "" {
+				t.Errorf("unexpected diff: %s", d)
+			}
+		})
+	}
+}
+
 type dryRunFlagsConfig struct {
 	isHelmV4             bool
 	supportsDryRunLookup bool

cmd/local.go

@@ -250,5 +250,6 @@ func (l *local) renderChart(chartPath string) ([]byte, error) {
 		helmBin = "helm"
 	}
 	cmd := exec.Command(helmBin, args...)
-	return outputWithRichError(cmd)
+	out, err := outputWithRichError(cmd)
+	return stripOCIPullProgress(out), err
 }

go.mod

@@ -15,14 +15,14 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/term v0.44.0
+	golang.org/x/term v0.45.0
 	gopkg.in/yaml.v2 v2.4.0
-	helm.sh/helm/v4 v4.2.1
-	k8s.io/api v0.36.2
-	k8s.io/apiextensions-apiserver v0.36.1
-	k8s.io/apimachinery v0.36.2
-	k8s.io/cli-runtime v0.36.2
-	k8s.io/client-go v0.36.2
+	helm.sh/helm/v4 v4.2.3
+	k8s.io/api v0.36.3
+	k8s.io/apiextensions-apiserver v0.36.3
+	k8s.io/apimachinery v0.36.3
+	k8s.io/cli-runtime v0.36.3
+	k8s.io/client-go v0.36.3
 	sigs.k8s.io/yaml v1.6.0
 )
 
@@ -118,19 +118,19 @@ require (
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiserver v0.36.1 // indirect
-	k8s.io/component-base v0.36.1 // indirect
+	k8s.io/apiserver v0.36.3 // indirect
+	k8s.io/component-base v0.36.3 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
 	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
 	k8s.io/kubectl v0.36.1 // indirect
@@ -141,5 +141,5 @@ require (
 	sigs.k8s.io/kustomize/api v0.21.1 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.3 // indirect
 )