From 154993723aadf45601d124c6750e8f4ae3b9f2fd Mon Sep 17 00:00:00 2001
From: Sumit Solanki <sumit.solanki@ibm.com>
Date: Thu, 26 Mar 2026 20:42:56 +0530
Subject: [PATCH 01/28] refactor(cli): decouple EnvSettings from pkg/kube to
 avoid import cycles

Move the retrying round tripper used by EnvSettings into pkg/cli so
pkg/cli no longer imports pkg/kube. This preserves retry behavior while
breaking the import edge that triggers cycles for Helm library consumers
(such as the kustomize integration described in #31965).

Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
---
 pkg/cli/environment.go  |  3 +-
 pkg/cli/roundtripper.go | 82 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+), 2 deletions(-)
 create mode 100644 pkg/cli/roundtripper.go

diff --git a/pkg/cli/environment.go b/pkg/cli/environment.go
index 83b6bdbba..8faa628fc 100644
--- a/pkg/cli/environment.go
+++ b/pkg/cli/environment.go
@@ -35,7 +35,6 @@ import (
 
 	"helm.sh/helm/v4/internal/version"
 	"helm.sh/helm/v4/pkg/helmpath"
-	"helm.sh/helm/v4/pkg/kube"
 )
 
 // defaultMaxHistory sets the maximum number of releases to 0: unlimited
@@ -134,7 +133,7 @@ func New() *EnvSettings {
 			config.Burst = env.BurstLimit
 			config.QPS = env.QPS
 			config.Wrap(func(rt http.RoundTripper) http.RoundTripper {
-				return &kube.RetryingRoundTripper{Wrapped: rt}
+				return &retryingRoundTripper{wrapped: rt}
 			})
 			config.UserAgent = version.GetUserAgent()
 			return config
diff --git a/pkg/cli/roundtripper.go b/pkg/cli/roundtripper.go
new file mode 100644
index 000000000..040ecd48f
--- /dev/null
+++ b/pkg/cli/roundtripper.go
@@ -0,0 +1,82 @@
+/*
+Copyright The Helm Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cli
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+)
+
+// retryingRoundTripper retries selected transient Kubernetes API server failures.
+// Keeping this in pkg/cli avoids importing pkg/kube from EnvSettings.
+type retryingRoundTripper struct {
+	wrapped http.RoundTripper
+}
+
+func (rt *retryingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	return rt.roundTrip(req, 1, nil)
+}
+
+func (rt *retryingRoundTripper) roundTrip(req *http.Request, retry int, prevResp *http.Response) (*http.Response, error) {
+	if retry < 0 {
+		return prevResp, nil
+	}
+	resp, rtErr := rt.wrapped.RoundTrip(req)
+	if rtErr != nil {
+		return resp, rtErr
+	}
+	if resp.StatusCode < 500 {
+		return resp, rtErr
+	}
+	if resp.Header.Get("content-type") != "application/json" {
+		return resp, rtErr
+	}
+	b, err := io.ReadAll(resp.Body)
+	resp.Body.Close()
+	if err != nil {
+		return resp, err
+	}
+
+	var ke kubernetesError
+	r := bytes.NewReader(b)
+	err = json.NewDecoder(r).Decode(&ke)
+	r.Seek(0, io.SeekStart)
+	resp.Body = io.NopCloser(r)
+	if err != nil {
+		return resp, err
+	}
+	if ke.Code < 500 {
+		return resp, nil
+	}
+	// Matches messages like "etcdserver: leader changed"
+	if strings.HasSuffix(ke.Message, "etcdserver: leader changed") {
+		return rt.roundTrip(req, retry-1, resp)
+	}
+	// Matches messages like "rpc error: code = Unknown desc = raft proposal dropped"
+	if strings.HasSuffix(ke.Message, "raft proposal dropped") {
+		return rt.roundTrip(req, retry-1, resp)
+	}
+	return resp, nil
+}
+
+type kubernetesError struct {
+	Message string `json:"message"`
+	Code    int    `json:"code"`
+}

From 64f1d0af5b53f0a9292af2ba1efc42a46a57ed00 Mon Sep 17 00:00:00 2001
From: Sumit Solanki <sumit.solanki@ibm.com>
Date: Fri, 27 Mar 2026 11:56:33 +0530
Subject: [PATCH 02/28] refactor(cli): decouple EnvSettings from pkg/kube

Move the retrying HTTP round-tripper used by EnvSettings into pkg/cli so
pkg/cli no longer imports pkg/kube, avoiding import cycles for Helm
library consumers while preserving retry behavior for transient API
server errors.

Add pkg/cli/roundtripper_test.go with parity coverage for the moved logic.

Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
Made-with: Cursor
---
 pkg/cli/roundtripper_test.go | 161 +++++++++++++++++++++++++++++++++++
 1 file changed, 161 insertions(+)
 create mode 100644 pkg/cli/roundtripper_test.go

diff --git a/pkg/cli/roundtripper_test.go b/pkg/cli/roundtripper_test.go
new file mode 100644
index 000000000..68fc075b0
--- /dev/null
+++ b/pkg/cli/roundtripper_test.go
@@ -0,0 +1,161 @@
+/*
+Copyright The Helm Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cli
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type fakeRoundTripper struct {
+	resp  *http.Response
+	err   error
+	calls int
+}
+
+func (f *fakeRoundTripper) RoundTrip(_ *http.Request) (*http.Response, error) {
+	f.calls++
+	return f.resp, f.err
+}
+
+func newRespWithBody(statusCode int, contentType, body string) *http.Response {
+	return &http.Response{
+		StatusCode: statusCode,
+		Header:     http.Header{"Content-Type": []string{contentType}},
+		Body:       io.NopCloser(strings.NewReader(body)),
+	}
+}
+
+func TestRetryingRoundTripper_RoundTrip(t *testing.T) {
+	marshalErr := func(code int, msg string) string {
+		b, _ := json.Marshal(kubernetesError{
+			Code:    code,
+			Message: msg,
+		})
+		return string(b)
+	}
+
+	tests := []struct {
+		name          string
+		resp          *http.Response
+		err           error
+		expectedCalls int
+		expectedErr   string
+		expectedCode  int
+	}{
+		{
+			name:          "no retry, status < 500 returns response",
+			resp:          newRespWithBody(200, "application/json", `{"message":"ok","code":200}`),
+			err:           nil,
+			expectedCalls: 1,
+			expectedCode:  200,
+		},
+		{
+			name:          "error from wrapped RoundTripper propagates",
+			resp:          nil,
+			err:           errors.New("wrapped error"),
+			expectedCalls: 1,
+			expectedErr:   "wrapped error",
+		},
+		{
+			name:          "no retry, content-type not application/json",
+			resp:          newRespWithBody(500, "text/plain", "server error"),
+			err:           nil,
+			expectedCalls: 1,
+			expectedCode:  500,
+		},
+		{
+			name: "error reading body returns error",
+			resp: &http.Response{
+				StatusCode: http.StatusInternalServerError,
+				Header:     http.Header{"Content-Type": []string{"application/json"}},
+				Body:       &errReader{},
+			},
+			err:           nil,
+			expectedCalls: 1,
+			expectedErr:   "read error",
+		},
+		{
+			name:          "error decoding JSON returns error",
+			resp:          newRespWithBody(500, "application/json", `invalid-json`),
+			err:           nil,
+			expectedCalls: 1,
+			expectedErr:   "invalid character",
+		},
+		{
+			name:          "retry on etcdserver leader changed message",
+			resp:          newRespWithBody(500, "application/json", marshalErr(500, "some error etcdserver: leader changed")),
+			err:           nil,
+			expectedCalls: 2,
+			expectedCode:  500,
+		},
+		{
+			name:          "retry on raft proposal dropped message",
+			resp:          newRespWithBody(500, "application/json", marshalErr(500, "rpc error: code = Unknown desc = raft proposal dropped")),
+			err:           nil,
+			expectedCalls: 2,
+			expectedCode:  500,
+		},
+		{
+			name:          "no retry on other error message",
+			resp:          newRespWithBody(500, "application/json", marshalErr(500, "other server error")),
+			err:           nil,
+			expectedCalls: 1,
+			expectedCode:  500,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fakeRT := &fakeRoundTripper{
+				resp: tt.resp,
+				err:  tt.err,
+			}
+			rt := retryingRoundTripper{
+				wrapped: fakeRT,
+			}
+			req, _ := http.NewRequest(http.MethodGet, "http://example.com", nil)
+			resp, err := rt.RoundTrip(req)
+
+			if tt.expectedErr != "" {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), tt.expectedErr)
+				return
+			}
+			assert.NoError(t, err)
+
+			assert.Equal(t, tt.expectedCode, resp.StatusCode)
+			assert.Equal(t, tt.expectedCalls, fakeRT.calls)
+		})
+	}
+}
+
+type errReader struct{}
+
+func (e *errReader) Read(_ []byte) (int, error) {
+	return 0, errors.New("read error")
+}
+
+func (e *errReader) Close() error {
+	return nil
+}

From 213c869a988f2c7390c65673e3d677970d6220fd Mon Sep 17 00:00:00 2001
From: Sumit Solanki <sumit.solanki@ibm.com>
Date: Thu, 9 Apr 2026 22:46:41 +0530
Subject: [PATCH 03/28] refactor(cli): share RetryingRoundTripper via
 pkg/kubeenv

Move implementation to pkg/kubeenv per review; kube.RetryingRoundTripper
remains a type alias for API compatibility. pkg/cli uses kubeenv only.

Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
---
 pkg/cli/environment.go                     |   3 +-
 pkg/cli/roundtripper_test.go               | 161 ---------------------
 pkg/kube/roundtripper.go                   |  66 +--------
 pkg/{cli => kubeenv}/roundtripper.go       |  18 ++-
 pkg/{kube => kubeenv}/roundtripper_test.go |   2 +-
 5 files changed, 18 insertions(+), 232 deletions(-)
 delete mode 100644 pkg/cli/roundtripper_test.go
 rename pkg/{cli => kubeenv}/roundtripper.go (77%)
 rename pkg/{kube => kubeenv}/roundtripper_test.go (99%)

diff --git a/pkg/cli/environment.go b/pkg/cli/environment.go
index 8faa628fc..45d773eb4 100644
--- a/pkg/cli/environment.go
+++ b/pkg/cli/environment.go
@@ -35,6 +35,7 @@ import (
 
 	"helm.sh/helm/v4/internal/version"
 	"helm.sh/helm/v4/pkg/helmpath"
+	"helm.sh/helm/v4/pkg/kubeenv"
 )
 
 // defaultMaxHistory sets the maximum number of releases to 0: unlimited
@@ -133,7 +134,7 @@ func New() *EnvSettings {
 			config.Burst = env.BurstLimit
 			config.QPS = env.QPS
 			config.Wrap(func(rt http.RoundTripper) http.RoundTripper {
-				return &retryingRoundTripper{wrapped: rt}
+				return &kubeenv.RetryingRoundTripper{Wrapped: rt}
 			})
 			config.UserAgent = version.GetUserAgent()
 			return config
diff --git a/pkg/cli/roundtripper_test.go b/pkg/cli/roundtripper_test.go
deleted file mode 100644
index 68fc075b0..000000000
--- a/pkg/cli/roundtripper_test.go
+++ /dev/null
@@ -1,161 +0,0 @@
-/*
-Copyright The Helm Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package cli
-
-import (
-	"encoding/json"
-	"errors"
-	"io"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-type fakeRoundTripper struct {
-	resp  *http.Response
-	err   error
-	calls int
-}
-
-func (f *fakeRoundTripper) RoundTrip(_ *http.Request) (*http.Response, error) {
-	f.calls++
-	return f.resp, f.err
-}
-
-func newRespWithBody(statusCode int, contentType, body string) *http.Response {
-	return &http.Response{
-		StatusCode: statusCode,
-		Header:     http.Header{"Content-Type": []string{contentType}},
-		Body:       io.NopCloser(strings.NewReader(body)),
-	}
-}
-
-func TestRetryingRoundTripper_RoundTrip(t *testing.T) {
-	marshalErr := func(code int, msg string) string {
-		b, _ := json.Marshal(kubernetesError{
-			Code:    code,
-			Message: msg,
-		})
-		return string(b)
-	}
-
-	tests := []struct {
-		name          string
-		resp          *http.Response
-		err           error
-		expectedCalls int
-		expectedErr   string
-		expectedCode  int
-	}{
-		{
-			name:          "no retry, status < 500 returns response",
-			resp:          newRespWithBody(200, "application/json", `{"message":"ok","code":200}`),
-			err:           nil,
-			expectedCalls: 1,
-			expectedCode:  200,
-		},
-		{
-			name:          "error from wrapped RoundTripper propagates",
-			resp:          nil,
-			err:           errors.New("wrapped error"),
-			expectedCalls: 1,
-			expectedErr:   "wrapped error",
-		},
-		{
-			name:          "no retry, content-type not application/json",
-			resp:          newRespWithBody(500, "text/plain", "server error"),
-			err:           nil,
-			expectedCalls: 1,
-			expectedCode:  500,
-		},
-		{
-			name: "error reading body returns error",
-			resp: &http.Response{
-				StatusCode: http.StatusInternalServerError,
-				Header:     http.Header{"Content-Type": []string{"application/json"}},
-				Body:       &errReader{},
-			},
-			err:           nil,
-			expectedCalls: 1,
-			expectedErr:   "read error",
-		},
-		{
-			name:          "error decoding JSON returns error",
-			resp:          newRespWithBody(500, "application/json", `invalid-json`),
-			err:           nil,
-			expectedCalls: 1,
-			expectedErr:   "invalid character",
-		},
-		{
-			name:          "retry on etcdserver leader changed message",
-			resp:          newRespWithBody(500, "application/json", marshalErr(500, "some error etcdserver: leader changed")),
-			err:           nil,
-			expectedCalls: 2,
-			expectedCode:  500,
-		},
-		{
-			name:          "retry on raft proposal dropped message",
-			resp:          newRespWithBody(500, "application/json", marshalErr(500, "rpc error: code = Unknown desc = raft proposal dropped")),
-			err:           nil,
-			expectedCalls: 2,
-			expectedCode:  500,
-		},
-		{
-			name:          "no retry on other error message",
-			resp:          newRespWithBody(500, "application/json", marshalErr(500, "other server error")),
-			err:           nil,
-			expectedCalls: 1,
-			expectedCode:  500,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			fakeRT := &fakeRoundTripper{
-				resp: tt.resp,
-				err:  tt.err,
-			}
-			rt := retryingRoundTripper{
-				wrapped: fakeRT,
-			}
-			req, _ := http.NewRequest(http.MethodGet, "http://example.com", nil)
-			resp, err := rt.RoundTrip(req)
-
-			if tt.expectedErr != "" {
-				assert.Error(t, err)
-				assert.Contains(t, err.Error(), tt.expectedErr)
-				return
-			}
-			assert.NoError(t, err)
-
-			assert.Equal(t, tt.expectedCode, resp.StatusCode)
-			assert.Equal(t, tt.expectedCalls, fakeRT.calls)
-		})
-	}
-}
-
-type errReader struct{}
-
-func (e *errReader) Read(_ []byte) (int, error) {
-	return 0, errors.New("read error")
-}
-
-func (e *errReader) Close() error {
-	return nil
-}
diff --git a/pkg/kube/roundtripper.go b/pkg/kube/roundtripper.go
index 52cb5bad2..e13f2103a 100644
--- a/pkg/kube/roundtripper.go
+++ b/pkg/kube/roundtripper.go
@@ -16,65 +16,9 @@ limitations under the License.
 
 package kube
 
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/http"
-	"strings"
-)
+import "helm.sh/helm/v4/pkg/kubeenv"
 
-type RetryingRoundTripper struct {
-	Wrapped http.RoundTripper
-}
-
-func (rt *RetryingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	return rt.roundTrip(req, 1, nil)
-}
-
-func (rt *RetryingRoundTripper) roundTrip(req *http.Request, retry int, prevResp *http.Response) (*http.Response, error) {
-	if retry < 0 {
-		return prevResp, nil
-	}
-	resp, rtErr := rt.Wrapped.RoundTrip(req)
-	if rtErr != nil {
-		return resp, rtErr
-	}
-	if resp.StatusCode < 500 {
-		return resp, rtErr
-	}
-	if resp.Header.Get("content-type") != "application/json" {
-		return resp, rtErr
-	}
-	b, err := io.ReadAll(resp.Body)
-	resp.Body.Close()
-	if err != nil {
-		return resp, err
-	}
-
-	var ke kubernetesError
-	r := bytes.NewReader(b)
-	err = json.NewDecoder(r).Decode(&ke)
-	r.Seek(0, io.SeekStart)
-	resp.Body = io.NopCloser(r)
-	if err != nil {
-		return resp, err
-	}
-	if ke.Code < 500 {
-		return resp, nil
-	}
-	// Matches messages like "etcdserver: leader changed"
-	if strings.HasSuffix(ke.Message, "etcdserver: leader changed") {
-		return rt.roundTrip(req, retry-1, resp)
-	}
-	// Matches messages like "rpc error: code = Unknown desc = raft proposal dropped"
-	if strings.HasSuffix(ke.Message, "raft proposal dropped") {
-		return rt.roundTrip(req, retry-1, resp)
-	}
-	return resp, nil
-}
-
-type kubernetesError struct {
-	Message string `json:"message"`
-	Code    int    `json:"code"`
-}
+// RetryingRoundTripper retries transient Kubernetes API server errors on a
+// wrapped [http.RoundTripper]. The implementation lives in [kubeenv] so
+// consumers can depend on that package without importing all of kube.
+type RetryingRoundTripper = kubeenv.RetryingRoundTripper
diff --git a/pkg/cli/roundtripper.go b/pkg/kubeenv/roundtripper.go
similarity index 77%
rename from pkg/cli/roundtripper.go
rename to pkg/kubeenv/roundtripper.go
index 040ecd48f..e00f93984 100644
--- a/pkg/cli/roundtripper.go
+++ b/pkg/kubeenv/roundtripper.go
@@ -14,7 +14,9 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package cli
+// Package kubeenv holds small, cycle-free Kubernetes client helpers shared by
+// higher-level packages (for example pkg/cli and pkg/kube).
+package kubeenv
 
 import (
 	"bytes"
@@ -24,21 +26,21 @@ import (
 	"strings"
 )
 
-// retryingRoundTripper retries selected transient Kubernetes API server failures.
-// Keeping this in pkg/cli avoids importing pkg/kube from EnvSettings.
-type retryingRoundTripper struct {
-	wrapped http.RoundTripper
+// RetryingRoundTripper retries transient Kubernetes API server errors on a
+// wrapped [http.RoundTripper].
+type RetryingRoundTripper struct {
+	Wrapped http.RoundTripper
 }
 
-func (rt *retryingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+func (rt *RetryingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	return rt.roundTrip(req, 1, nil)
 }
 
-func (rt *retryingRoundTripper) roundTrip(req *http.Request, retry int, prevResp *http.Response) (*http.Response, error) {
+func (rt *RetryingRoundTripper) roundTrip(req *http.Request, retry int, prevResp *http.Response) (*http.Response, error) {
 	if retry < 0 {
 		return prevResp, nil
 	}
-	resp, rtErr := rt.wrapped.RoundTrip(req)
+	resp, rtErr := rt.Wrapped.RoundTrip(req)
 	if rtErr != nil {
 		return resp, rtErr
 	}
diff --git a/pkg/kube/roundtripper_test.go b/pkg/kubeenv/roundtripper_test.go
similarity index 99%
rename from pkg/kube/roundtripper_test.go
rename to pkg/kubeenv/roundtripper_test.go
index 96602c1f4..b921eac82 100644
--- a/pkg/kube/roundtripper_test.go
+++ b/pkg/kubeenv/roundtripper_test.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package kube
+package kubeenv
 
 import (
 	"encoding/json"

From c26be60d81e5cb6a147d6088477cf86fd5aaf1f0 Mon Sep 17 00:00:00 2001
From: Cairon <cairon-ab@users.noreply.github.com>
Date: Fri, 10 Apr 2026 11:11:38 -0400
Subject: [PATCH 04/28] fix: add debug logging to HTTP getter for helm pull

When running 'helm pull --debug', no debug output was printed because
the HTTP getter did not emit any slog.Debug messages. This adds
slog.Debug calls to log the URL being fetched and the response status
when debug-level logging is enabled.

Fixes helm/helm#31098

Signed-off-by: Cairon <cairon-ab@users.noreply.github.com>
---
 pkg/getter/httpgetter.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkg/getter/httpgetter.go b/pkg/getter/httpgetter.go
index 2bc12bdbf..2eb2d5d8c 100644
--- a/pkg/getter/httpgetter.go
+++ b/pkg/getter/httpgetter.go
@@ -20,6 +20,7 @@ import (
 	"crypto/tls"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"net/url"
 	"sync"
@@ -87,11 +88,13 @@ func (g *HTTPGetter) get(href string, opts getterOptions) (*bytes.Buffer, error)
 		return nil, err
 	}
 
+	slog.Debug("fetching", "url", href)
 	resp, err := client.Do(req)
 	if err != nil {
 		return nil, err
 	}
 	defer resp.Body.Close()
+	slog.Debug("fetch complete", "url", href, "status", resp.Status, "content-length", resp.ContentLength)
 	if resp.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("failed to fetch %s : %s", href, resp.Status)
 	}

From 277d9702555532d13426119d31c70fffb389d589 Mon Sep 17 00:00:00 2001
From: Gagan H R <hrgagan4@gmail.com>
Date: Tue, 28 Apr 2026 22:32:21 +0530
Subject: [PATCH 05/28] fix: adds topLevel permissions to improve openSSF
 scores

Signed-off-by: Gagan H R <hrgagan4@gmail.com>
---
 .github/workflows/codeql-analysis.yml | 7 ++++---
 .github/workflows/stale.yaml          | 5 +++++
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 972602fea..51ba3ed3f 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -24,14 +24,15 @@ on:
   schedule:
     - cron: '29 6 * * 6'
 
-permissions:  
-  contents: read
-  security-events: write
+permissions: {}
 
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
 
     strategy:
       fail-fast: false
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index 7d41280ad..9b0c29952 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -3,9 +3,14 @@ on:
   schedule:
   - cron: "0 0 * * *"
 
+permissions: {}
+
 jobs:
   stale:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
     - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
       with:

From 081c6dff537087f52ec6e470d8986439e24e8e33 Mon Sep 17 00:00:00 2001
From: Matheus Pimenta <matheuscscp@gmail.com>
Date: Thu, 30 Apr 2026 14:23:01 +0100
Subject: [PATCH 06/28] Upgrade kstatus to 1.2 and controller-runtime to 0.24

Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
---
 go.mod | 4 ++--
 go.sum | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index bcddd6986..182898384 100644
--- a/go.mod
+++ b/go.mod
@@ -17,7 +17,7 @@ require (
 	github.com/evanphx/json-patch/v5 v5.9.11
 	github.com/extism/go-sdk v1.7.1
 	github.com/fatih/color v1.19.0
-	github.com/fluxcd/cli-utils v1.1.0
+	github.com/fluxcd/cli-utils v1.2.0
 	github.com/foxcpp/go-mockdns v1.2.0
 	github.com/gobwas/glob v0.2.3
 	github.com/gofrs/flock v0.13.0
@@ -48,7 +48,7 @@ require (
 	k8s.io/klog/v2 v2.140.0
 	k8s.io/kubectl v0.36.0
 	oras.land/oras-go/v2 v2.6.0
-	sigs.k8s.io/controller-runtime v0.23.3
+	sigs.k8s.io/controller-runtime v0.24.0
 	sigs.k8s.io/kustomize/kyaml v0.21.1
 	sigs.k8s.io/yaml v1.6.0
 )
diff --git a/go.sum b/go.sum
index 9b7f40f94..9d9e3fee4 100644
--- a/go.sum
+++ b/go.sum
@@ -93,8 +93,8 @@ github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fluxcd/cli-utils v1.1.0 h1:P2oULlj4aNSqjBGcWOCQS+TOS5ZSyoJMy1zYCpqsYus=
-github.com/fluxcd/cli-utils v1.1.0/go.mod h1:+ipwad8nfETe+VB3SMgrDv6m0mqA/KQSj2wyn8Y7vmo=
+github.com/fluxcd/cli-utils v1.2.0 h1:1o07pXTMxJ/XJ1GpAbLtjdXwfCUMq4Ku1OcnvJHLohI=
+github.com/fluxcd/cli-utils v1.2.0/go.mod h1:d5HdTDdR5sCbsIbgtOQ7x7srKYwYeZORU6CD2yn4j/M=
 github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0=
 github.com/foxcpp/go-mockdns v1.2.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
@@ -509,8 +509,8 @@ k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0x
 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
 oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
 oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
-sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4iqwZ80=
-sigs.k8s.io/controller-runtime v0.23.3/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
+sigs.k8s.io/controller-runtime v0.24.0 h1:Ck6N2LdS8Lovy1o25BB4r1xjvLEKUl1s2o9kU+KWDE4=
+sigs.k8s.io/controller-runtime v0.24.0/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=

From e61bbfbfff41958b0ba1984e4d6799fe131f325e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 30 Apr 2026 21:34:33 +0000
Subject: [PATCH 07/28] chore(deps): bump github.com/Masterminds/semver/v3 from
 3.4.0 to 3.5.0

Bumps [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) from 3.4.0 to 3.5.0.
- [Release notes](https://github.com/Masterminds/semver/releases)
- [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Masterminds/semver/compare/v3.4.0...v3.5.0)

---
updated-dependencies:
- dependency-name: github.com/Masterminds/semver/v3
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 182898384..323d6eedb 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@ require (
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24
 	github.com/BurntSushi/toml v1.6.0
 	github.com/DATA-DOG/go-sqlmock v1.5.2
-	github.com/Masterminds/semver/v3 v3.4.0
+	github.com/Masterminds/semver/v3 v3.5.0
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/Masterminds/squirrel v1.5.4
 	github.com/Masterminds/vcs v1.13.3
diff --git a/go.sum b/go.sum
index 9d9e3fee4..d47661f15 100644
--- a/go.sum
+++ b/go.sum
@@ -14,8 +14,8 @@ github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ
 github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
-github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
 github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8afzqM=

From 58e8ffdc3302260b1b55718c9b72c6f169a76ee0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 2 May 2026 00:58:20 +0000
Subject: [PATCH 08/28] chore(deps): bump github/codeql-action from 4.35.2 to
 4.35.3

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/codeql-analysis.yml | 6 +++---
 .github/workflows/scorecards.yml      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 51ba3ed3f..6714fc8de 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -48,7 +48,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # pinv4.35.2
+      uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # pinv4.35.3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -59,7 +59,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # pinv4.35.2
+      uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # pinv4.35.3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -73,4 +73,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # pinv4.35.2
+      uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # pinv4.35.3
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 41e2f1254..5d78ddd61 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -64,6 +64,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
         with:
           sarif_file: results.sarif

From 12f2c41c0d7a74739c58a5995cbbb3125d9247e5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 2 May 2026 01:01:06 +0000
Subject: [PATCH 09/28] chore(deps): bump
 github.com/distribution/distribution/v3

Bumps [github.com/distribution/distribution/v3](https://github.com/distribution/distribution) from 3.1.0 to 3.1.1.
- [Release notes](https://github.com/distribution/distribution/releases)
- [Commits](https://github.com/distribution/distribution/compare/v3.1.0...v3.1.1)

---
updated-dependencies:
- dependency-name: github.com/distribution/distribution/v3
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 323d6eedb..40c02c7e1 100644
--- a/go.mod
+++ b/go.mod
@@ -13,7 +13,7 @@ require (
 	github.com/ProtonMail/go-crypto v1.4.1
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
 	github.com/cyphar/filepath-securejoin v0.6.1
-	github.com/distribution/distribution/v3 v3.1.0
+	github.com/distribution/distribution/v3 v3.1.1
 	github.com/evanphx/json-patch/v5 v5.9.11
 	github.com/extism/go-sdk v1.7.1
 	github.com/fatih/color v1.19.0
diff --git a/go.sum b/go.sum
index d47661f15..f1a2ca9f8 100644
--- a/go.sum
+++ b/go.sum
@@ -67,8 +67,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
-github.com/distribution/distribution/v3 v3.1.0 h1:u1v788HreKTLGdNY6s7px8Exgrs9mZ9UrCDjSrpCM8g=
-github.com/distribution/distribution/v3 v3.1.0/go.mod h1:73BuF5/ziMHNVt7nnL1roYpH4Eg/FgUlKZm3WryIx/o=
+github.com/distribution/distribution/v3 v3.1.1 h1:KUbk7C8CfaLXy8kbf/hGq9cad/wCoLB6dbWH6DMbmX0=
+github.com/distribution/distribution/v3 v3.1.1/go.mod h1:d7lXwZpph0bVcOj4Aqn0nMrWHIwRQGdiV5TLeI+/w6Y=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=

From 075c096afec70155bc43ac3587a119df1ae5fcc6 Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Mon, 29 Sep 2025 10:00:19 -0600
Subject: [PATCH 10/28] chore: replace mitchellh/gox with goreleaser

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 .goreleaser.yml | 78 +++++++++++++++++++++++++++++++++++++++++++++++++
 Makefile        | 11 +++----
 2 files changed, 84 insertions(+), 5 deletions(-)
 create mode 100644 .goreleaser.yml

diff --git a/.goreleaser.yml b/.goreleaser.yml
new file mode 100644
index 000000000..264a4f206
--- /dev/null
+++ b/.goreleaser.yml
@@ -0,0 +1,78 @@
+project_name: helm
+
+before:
+  hooks:
+    - go mod tidy
+
+dist: _dist
+builds:
+  - env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - windows
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+      - arm
+      - "386"
+      - ppc64le
+      - s390x
+      - riscv64
+    goarm:
+      - "7"
+    ignore:
+      - goos: darwin
+        goarch: "386"
+      - goos: darwin
+        goarch: arm
+      - goos: darwin
+        goarch: ppc64le
+      - goos: darwin
+        goarch: s390x
+      - goos: darwin
+        goarch: riscv64
+      - goos: windows
+        goarch: arm
+      - goos: windows
+        goarch: ppc64le
+      - goos: windows
+        goarch: s390x
+      - goos: windows
+        goarch: riscv64
+    main: ./cmd/helm
+    binary: helm
+    ldflags:
+      - "{{ .Env.LDFLAGS }}"
+    flags:
+      - -trimpath
+    dir: .
+
+archives:
+  - format: tar.gz
+    # this name template makes the OS and Arch compatible with the results of uname.
+    name_template: >-
+      {{ .ProjectName }}-
+      {{- title .Os }}-
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "386" }}i386
+      {{- else }}{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end }}
+    # use zip for windows archives
+    format_overrides:
+    - goos: windows
+      format: zip
+
+checksum:
+  name_template: 'checksums.txt'
+
+snapshot:
+  name_template: "{{ incpatch .Version }}-next"
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - '^docs:'
+      - '^test:'
\ No newline at end of file
diff --git a/Makefile b/Makefile
index a18b83f0d..3d4d8261e 100644
--- a/Makefile
+++ b/Makefile
@@ -9,7 +9,8 @@ GOBIN         = $(shell go env GOBIN)
 ifeq ($(GOBIN),)
 GOBIN         = $(shell go env GOPATH)/bin
 endif
-GOX           = $(GOBIN)/gox
+GOTOOLCHAIN   = $(shell awk '/^go / {print "go" $$2}' go.mod)
+GORELEASER    = $(GOBIN)/goreleaser
 GOIMPORTS     = $(GOBIN)/goimports
 ARCH          = $(shell go env GOARCH)
 
@@ -162,8 +163,8 @@ gen-test-golden: test-unit
 # dependencies to the go.mod file. To avoid that we change to a directory
 # without a go.mod file when downloading the following dependencies
 
-$(GOX):
-	(cd /; go install github.com/mitchellh/gox@v1.0.2-0.20220701044238-9f712387e2d2)
+$(GORELEASER):
+	(cd /; GOTOOLCHAIN=$(GOTOOLCHAIN) go install github.com/goreleaser/goreleaser@latest)
 
 $(GOIMPORTS):
 	(cd /; go install golang.org/x/tools/cmd/goimports@latest)
@@ -173,8 +174,8 @@ $(GOIMPORTS):
 
 .PHONY: build-cross
 build-cross: LDFLAGS += -extldflags "-static"
-build-cross: $(GOX)
-	GOFLAGS="-trimpath" CGO_ENABLED=0 $(GOX) -parallel=3 -output="_dist/{{.OS}}-{{.Arch}}/$(BINNAME)" -osarch='$(TARGETS)' $(GOFLAGS) -tags '$(TAGS)' -ldflags '$(LDFLAGS)' ./cmd/helm
+build-cross: $(GORELEASER)
+	LDFLAGS='$(LDFLAGS)' $(GORELEASER) build --snapshot --clean
 
 .PHONY: dist
 dist:

From e7bea8513c30475664919f031774e18fecdf1f66 Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Wed, 29 Oct 2025 13:02:15 -0600
Subject: [PATCH 11/28] remove GOTOOLCHAIN

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 Makefile | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 3d4d8261e..85fae12b2 100644
--- a/Makefile
+++ b/Makefile
@@ -9,7 +9,6 @@ GOBIN         = $(shell go env GOBIN)
 ifeq ($(GOBIN),)
 GOBIN         = $(shell go env GOPATH)/bin
 endif
-GOTOOLCHAIN   = $(shell awk '/^go / {print "go" $$2}' go.mod)
 GORELEASER    = $(GOBIN)/goreleaser
 GOIMPORTS     = $(GOBIN)/goimports
 ARCH          = $(shell go env GOARCH)
@@ -164,7 +163,7 @@ gen-test-golden: test-unit
 # without a go.mod file when downloading the following dependencies
 
 $(GORELEASER):
-	(cd /; GOTOOLCHAIN=$(GOTOOLCHAIN) go install github.com/goreleaser/goreleaser@latest)
+	(cd /; go install github.com/goreleaser/goreleaser@latest)
 
 $(GOIMPORTS):
 	(cd /; go install golang.org/x/tools/cmd/goimports@latest)

From e368f170af8a200e672adac5f765b8101db0c8fa Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Wed, 29 Oct 2025 13:30:27 -0600
Subject: [PATCH 12/28] update configuration to v2

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 .goreleaser.yml | 13 +++++++------
 Makefile        |  3 ++-
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index 264a4f206..5ac434dda 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -1,3 +1,5 @@
+version: 2
+
 project_name: helm
 
 before:
@@ -50,7 +52,7 @@ builds:
     dir: .
 
 archives:
-  - format: tar.gz
+  - id: default
     # this name template makes the OS and Arch compatible with the results of uname.
     name_template: >-
       {{ .ProjectName }}-
@@ -59,16 +61,15 @@ archives:
       {{- else if eq .Arch "386" }}i386
       {{- else }}{{ .Arch }}{{ end }}
       {{- if .Arm }}v{{ .Arm }}{{ end }}
-    # use zip for windows archives
-    format_overrides:
-    - goos: windows
-      format: zip
+    files:
+      - LICENSE
+      - README.md
 
 checksum:
   name_template: 'checksums.txt'
 
 snapshot:
-  name_template: "{{ incpatch .Version }}-next"
+  version_template: "{{ incpatch .Version }}-next"
 
 changelog:
   sort: asc
diff --git a/Makefile b/Makefile
index 85fae12b2..022320d1f 100644
--- a/Makefile
+++ b/Makefile
@@ -163,7 +163,8 @@ gen-test-golden: test-unit
 # without a go.mod file when downloading the following dependencies
 
 $(GORELEASER):
-	(cd /; go install github.com/goreleaser/goreleaser@latest)
+	echo go install github.com/goreleaser/goreleaser/v2@latest
+	(cd /; go install github.com/goreleaser/goreleaser/v2@latest)
 
 $(GOIMPORTS):
 	(cd /; go install golang.org/x/tools/cmd/goimports@latest)

From a9659b07e3eec20ab5b964fddae05f51f478f704 Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Wed, 29 Oct 2025 13:49:24 -0600
Subject: [PATCH 13/28] fix artifact directory

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 .goreleaser.yml => .goreleaser.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
 rename .goreleaser.yml => .goreleaser.yaml (91%)

diff --git a/.goreleaser.yml b/.goreleaser.yaml
similarity index 91%
rename from .goreleaser.yml
rename to .goreleaser.yaml
index 5ac434dda..a81a97845 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yaml
@@ -35,6 +35,8 @@ builds:
         goarch: s390x
       - goos: darwin
         goarch: riscv64
+      - goos: windows
+        goarch: "386"
       - goos: windows
         goarch: arm
       - goos: windows
@@ -44,7 +46,8 @@ builds:
       - goos: windows
         goarch: riscv64
     main: ./cmd/helm
-    binary: helm
+    no_unique_dist_dir: true
+    binary: "{{ .Os }}-{{ .Arch }}/helm"
     ldflags:
       - "{{ .Env.LDFLAGS }}"
     flags:
@@ -55,7 +58,6 @@ archives:
   - id: default
     # this name template makes the OS and Arch compatible with the results of uname.
     name_template: >-
-      {{ .ProjectName }}-
       {{- title .Os }}-
       {{- if eq .Arch "amd64" }}x86_64
       {{- else if eq .Arch "386" }}i386

From 45336ccd5b2621357e3f785c1fe93627c5990a6e Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Wed, 29 Oct 2025 15:02:22 -0600
Subject: [PATCH 14/28] add support for loong64

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 .goreleaser.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index a81a97845..f4d19a967 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -22,6 +22,7 @@ builds:
       - ppc64le
       - s390x
       - riscv64
+      - loong64
     goarm:
       - "7"
     ignore:
@@ -35,6 +36,8 @@ builds:
         goarch: s390x
       - goos: darwin
         goarch: riscv64
+      - goos: darwin
+        goarch: loong64
       - goos: windows
         goarch: "386"
       - goos: windows
@@ -45,6 +48,8 @@ builds:
         goarch: s390x
       - goos: windows
         goarch: riscv64
+      - goos: windows
+        goarch: loong64
     main: ./cmd/helm
     no_unique_dist_dir: true
     binary: "{{ .Os }}-{{ .Arch }}/helm"

From 37284a9211972f7f41a2acc3c3313517596dd4b0 Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Wed, 29 Oct 2025 15:30:10 -0600
Subject: [PATCH 15/28] fix goreleaser archive

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 .goreleaser.yaml | 8 ++++++--
 Makefile         | 8 +-------
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index f4d19a967..e7d93d01c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -63,11 +63,15 @@ archives:
   - id: default
     # this name template makes the OS and Arch compatible with the results of uname.
     name_template: >-
-      {{- title .Os }}-
+      {{- .ProjectName }}-
+      {{- .Version }}-
+      {{- .Os }}-
       {{- if eq .Arch "amd64" }}x86_64
       {{- else if eq .Arch "386" }}i386
       {{- else }}{{ .Arch }}{{ end }}
-      {{- if .Arm }}v{{ .Arm }}{{ end }}
+    formats:
+      - tar.gz
+      - zip
     files:
       - LICENSE
       - README.md
diff --git a/Makefile b/Makefile
index 022320d1f..bca7b28d8 100644
--- a/Makefile
+++ b/Makefile
@@ -179,13 +179,7 @@ build-cross: $(GORELEASER)
 
 .PHONY: dist
 dist:
-	( \
-		cd _dist && \
-		$(DIST_DIRS) cp ../LICENSE {} \; && \
-		$(DIST_DIRS) cp ../README.md {} \; && \
-		$(DIST_DIRS) tar -zcf helm-${VERSION}-{}.tar.gz {} \; && \
-		$(DIST_DIRS) zip -r helm-${VERSION}-{}.zip {} \; \
-	)
+	LDFLAGS='$(LDFLAGS)' $(GORELEASER) release --snapshot --clean
 
 .PHONY: fetch-dist
 fetch-dist:

From 5a75279c1a017a60b97bd44986288af7399c6ff8 Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Wed, 29 Oct 2025 16:03:51 -0600
Subject: [PATCH 16/28] Fix archive name

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 .github/workflows/release.yml | 1 -
 .goreleaser.yaml              | 4 +---
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 593003192..82a5a208a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -101,7 +101,6 @@ jobs:
 
       - name: Build Helm Binaries
         run: |
-          make build-cross
           make dist checksum VERSION="canary"
 
       - name: Upload Binaries
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index e7d93d01c..aedd77a1a 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -66,9 +66,7 @@ archives:
       {{- .ProjectName }}-
       {{- .Version }}-
       {{- .Os }}-
-      {{- if eq .Arch "amd64" }}x86_64
-      {{- else if eq .Arch "386" }}i386
-      {{- else }}{{ .Arch }}{{ end }}
+      {{- .Arch }}
     formats:
       - tar.gz
       - zip

From eaa09100b9b18175d878b1e114cbe9df2a3f70c2 Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Mon, 24 Nov 2025 05:20:57 -0700
Subject: [PATCH 17/28] fix: canary build file names

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 .goreleaser.yaml | 2 +-
 Makefile         | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index aedd77a1a..22bb4e379 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -78,7 +78,7 @@ checksum:
   name_template: 'checksums.txt'
 
 snapshot:
-  version_template: "{{ incpatch .Version }}-next"
+  version_template: "{{ if .Env.GORELEASER_CURRENT_TAG }}{{ .Env.GORELEASER_CURRENT_TAG }}{{ else }}{{ incpatch .Version }}-next{{ end }}"
 
 changelog:
   sort: asc
diff --git a/Makefile b/Makefile
index bca7b28d8..1e339fec4 100644
--- a/Makefile
+++ b/Makefile
@@ -179,7 +179,11 @@ build-cross: $(GORELEASER)
 
 .PHONY: dist
 dist:
+ifeq ($(VERSION),canary)
+	GORELEASER_CURRENT_TAG=canary LDFLAGS='$(LDFLAGS)' $(GORELEASER) release --snapshot --clean
+else
 	LDFLAGS='$(LDFLAGS)' $(GORELEASER) release --snapshot --clean
+endif
 
 .PHONY: fetch-dist
 fetch-dist:

From e49a1dc16eee526928d8928b8d96c01ee513ebd9 Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Sat, 2 May 2026 10:34:04 -0600
Subject: [PATCH 18/28] fix: use index for optional env var in version_template

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 .goreleaser.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 22bb4e379..c105e1813 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -78,7 +78,7 @@ checksum:
   name_template: 'checksums.txt'
 
 snapshot:
-  version_template: "{{ if .Env.GORELEASER_CURRENT_TAG }}{{ .Env.GORELEASER_CURRENT_TAG }}{{ else }}{{ incpatch .Version }}-next{{ end }}"
+  version_template: "{{ if index .Env \"GORELEASER_CURRENT_TAG\" }}{{ .Env.GORELEASER_CURRENT_TAG }}{{ else }}{{ incpatch .Version }}-next{{ end }}"
 
 changelog:
   sort: asc

From 93103ce66cb6374d9d7b552802f53b21ea2c2dd1 Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Sat, 2 May 2026 11:25:43 -0600
Subject: [PATCH 19/28] fix: disable goreleaser checksums.txt and restrict zip
 to windows only

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 .goreleaser.yaml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index c105e1813..f99faced0 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -69,13 +69,17 @@ archives:
       {{- .Arch }}
     formats:
       - tar.gz
-      - zip
+    format_overrides:
+      - goos: windows
+        formats:
+          - tar.gz
+          - zip
     files:
       - LICENSE
       - README.md
 
 checksum:
-  name_template: 'checksums.txt'
+  disable: true
 
 snapshot:
   version_template: "{{ if index .Env \"GORELEASER_CURRENT_TAG\" }}{{ .Env.GORELEASER_CURRENT_TAG }}{{ else }}{{ incpatch .Version }}-next{{ end }}"

From 04885dd905b6f8a823733dbc9b9f5cb2843a975f Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Sat, 2 May 2026 11:35:35 -0600
Subject: [PATCH 20/28] fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve
 v-prefix in archive names

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 Makefile | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/Makefile b/Makefile
index 1e339fec4..250deac75 100644
--- a/Makefile
+++ b/Makefile
@@ -179,11 +179,7 @@ build-cross: $(GORELEASER)
 
 .PHONY: dist
 dist:
-ifeq ($(VERSION),canary)
-	GORELEASER_CURRENT_TAG=canary LDFLAGS='$(LDFLAGS)' $(GORELEASER) release --snapshot --clean
-else
-	LDFLAGS='$(LDFLAGS)' $(GORELEASER) release --snapshot --clean
-endif
+	GORELEASER_CURRENT_TAG='$(VERSION)' LDFLAGS='$(LDFLAGS)' $(GORELEASER) release --snapshot --clean
 
 .PHONY: fetch-dist
 fetch-dist:

From c075022ce16489f5f7afd45a37b679cf58fa36ea Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Sat, 2 May 2026 11:50:15 -0600
Subject: [PATCH 21/28] fix: address goreleaser build issues flagged in review

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 .github/workflows/release.yml | 1 -
 .goreleaser.yaml              | 4 ----
 Makefile                      | 3 +--
 3 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 82a5a208a..01df0bda5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,6 @@ jobs:
         run: |
           set -eu -o pipefail
 
-          make build-cross VERSION="${{ github.ref_name }}"
           make dist checksum VERSION="${{ github.ref_name }}"
 
       - name: Set latest version
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index f99faced0..4046ee796 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -2,10 +2,6 @@ version: 2
 
 project_name: helm
 
-before:
-  hooks:
-    - go mod tidy
-
 dist: _dist
 builds:
   - env:
diff --git a/Makefile b/Makefile
index 250deac75..c7fc2f1f0 100644
--- a/Makefile
+++ b/Makefile
@@ -163,7 +163,6 @@ gen-test-golden: test-unit
 # without a go.mod file when downloading the following dependencies
 
 $(GORELEASER):
-	echo go install github.com/goreleaser/goreleaser/v2@latest
 	(cd /; go install github.com/goreleaser/goreleaser/v2@latest)
 
 $(GOIMPORTS):
@@ -178,7 +177,7 @@ build-cross: $(GORELEASER)
 	LDFLAGS='$(LDFLAGS)' $(GORELEASER) build --snapshot --clean
 
 .PHONY: dist
-dist:
+dist: $(GORELEASER)
 	GORELEASER_CURRENT_TAG='$(VERSION)' LDFLAGS='$(LDFLAGS)' $(GORELEASER) release --snapshot --clean
 
 .PHONY: fetch-dist

From 82899404a68f3826389bb38cf67bf75085db6b2c Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Sat, 2 May 2026 12:12:38 -0600
Subject: [PATCH 22/28] ci: add fetch-depth 0 to canary checkout for goreleaser

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 .github/workflows/release.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 01df0bda5..e50da2387 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -85,6 +85,8 @@ jobs:
     steps:
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        with:
+          fetch-depth: 0
 
       - name: Add variables to environment file
         run: cat ".github/env" >> "$GITHUB_ENV"

From d199a1a42c04bccb287f2c7d9c3f73b669412e5a Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Sat, 2 May 2026 12:25:35 -0600
Subject: [PATCH 23/28] chore: remove build-cross dependency from
 test-acceptance

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 Makefile | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index c7fc2f1f0..57365a025 100644
--- a/Makefile
+++ b/Makefile
@@ -130,8 +130,7 @@ test-source-headers:
 	@scripts/validate-license.sh
 
 .PHONY: test-acceptance
-test-acceptance: TARGETS = linux/amd64
-test-acceptance: build build-cross
+test-acceptance: build
 	@if [ -d "${ACCEPTANCE_DIR}" ]; then \
 		cd ${ACCEPTANCE_DIR} && \
 			ROBOT_RUN_TESTS=$(ACCEPTANCE_RUN_TESTS) ROBOT_HELM_PATH='$(BINDIR)' make acceptance; \

From 64aa46f2f1cf239cf6535c5e847e14dcb933a847 Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Sat, 2 May 2026 19:19:20 -0600
Subject: [PATCH 24/28] build: use goreleaser build with manual archive
 creation

goreleaser v2 has a bug with no_unique_dist_dir where it registers
archive tasks for all sub-arch variants even when constraints limit
builds to one per arch, causing archive collision errors. Switch dist
target to use goreleaser build (binaries only) and create tar.gz/zip
archives manually, copying LICENSE and README.md into each platform
directory to match the existing archive structure.

Add sub-arch constraints (goamd64, goarm64, go386, goriscv64) to ensure
only one variant is built per architecture.

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 .goreleaser.yaml | 32 +++++++++-----------------------
 Makefile         | 13 ++++++++++++-
 2 files changed, 21 insertions(+), 24 deletions(-)

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 4046ee796..ab2089882 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -19,8 +19,16 @@ builds:
       - s390x
       - riscv64
       - loong64
+    goamd64:
+      - v1
     goarm:
       - "7"
+    goarm64:
+      - v8.0
+    go386:
+      - sse2
+    goriscv64:
+      - rva20u64
     ignore:
       - goos: darwin
         goarch: "386"
@@ -55,28 +63,6 @@ builds:
       - -trimpath
     dir: .
 
-archives:
-  - id: default
-    # this name template makes the OS and Arch compatible with the results of uname.
-    name_template: >-
-      {{- .ProjectName }}-
-      {{- .Version }}-
-      {{- .Os }}-
-      {{- .Arch }}
-    formats:
-      - tar.gz
-    format_overrides:
-      - goos: windows
-        formats:
-          - tar.gz
-          - zip
-    files:
-      - LICENSE
-      - README.md
-
-checksum:
-  disable: true
-
 snapshot:
   version_template: "{{ if index .Env \"GORELEASER_CURRENT_TAG\" }}{{ .Env.GORELEASER_CURRENT_TAG }}{{ else }}{{ incpatch .Version }}-next{{ end }}"
 
@@ -85,4 +71,4 @@ changelog:
   filters:
     exclude:
       - '^docs:'
-      - '^test:'
\ No newline at end of file
+      - '^test:'
diff --git a/Makefile b/Makefile
index 57365a025..966380805 100644
--- a/Makefile
+++ b/Makefile
@@ -177,7 +177,18 @@ build-cross: $(GORELEASER)
 
 .PHONY: dist
 dist: $(GORELEASER)
-	GORELEASER_CURRENT_TAG='$(VERSION)' LDFLAGS='$(LDFLAGS)' $(GORELEASER) release --snapshot --clean
+	GORELEASER_CURRENT_TAG='$(VERSION)' LDFLAGS='$(LDFLAGS)' $(GORELEASER) build --snapshot --clean
+	@for platform_dir in _dist/*/; do \
+		platform=$$(basename "$$platform_dir"); \
+		{ [ -f "_dist/$$platform/helm" ] || [ -f "_dist/$$platform/helm.exe" ]; } || continue; \
+		cp LICENSE README.md "_dist/$$platform/"; \
+		tar czf "_dist/helm-$(VERSION)-$$platform.tar.gz" -C _dist "$$platform/"; \
+	done
+	@for platform_dir in _dist/windows-*/; do \
+		[ -d "$$platform_dir" ] || continue; \
+		platform=$$(basename "$$platform_dir"); \
+		(cd _dist && zip -r "helm-$(VERSION)-$$platform.zip" "$$platform/"); \
+	done
 
 .PHONY: fetch-dist
 fetch-dist:

From f60ab7c31c81a73b8e0aade5aff41bfc01c08820 Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Sat, 2 May 2026 19:40:24 -0600
Subject: [PATCH 25/28] fix: add -extldflags -static to dist target to match
 build-cross

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---
 Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Makefile b/Makefile
index 966380805..f68df780a 100644
--- a/Makefile
+++ b/Makefile
@@ -176,6 +176,7 @@ build-cross: $(GORELEASER)
 	LDFLAGS='$(LDFLAGS)' $(GORELEASER) build --snapshot --clean
 
 .PHONY: dist
+dist: LDFLAGS += -extldflags "-static"
 dist: $(GORELEASER)
 	GORELEASER_CURRENT_TAG='$(VERSION)' LDFLAGS='$(LDFLAGS)' $(GORELEASER) build --snapshot --clean
 	@for platform_dir in _dist/*/; do \

From e23bf3af53c52185123278e83b7023c102707778 Mon Sep 17 00:00:00 2001
From: Scott Rigby <scott@r6by.com>
Date: Mon, 4 May 2026 19:46:58 -0400
Subject: [PATCH 26/28] build: Clean up Goreleaser change (#32098)

Makefile:
- restore dist target
- remove unused LDFLAGS added to dist target
- remove unused TARGETS var

gh release action:
- restore build-cross to release and canary-release jobs

Signed-off-by: Scott Rigby <scott@r6by.com>
Co-authored-by: Terry Howe <terrylhowe@gmail.com>
---
 .github/workflows/release.yml |  2 ++
 Makefile                      | 23 ++++++++---------------
 2 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e50da2387..ab8a4a509 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,6 +38,7 @@ jobs:
         run: |
           set -eu -o pipefail
 
+          make build-cross VERSION="${{ github.ref_name }}"
           make dist checksum VERSION="${{ github.ref_name }}"
 
       - name: Set latest version
@@ -102,6 +103,7 @@ jobs:
 
       - name: Build Helm Binaries
         run: |
+          make build-cross
           make dist checksum VERSION="canary"
 
       - name: Upload Binaries
diff --git a/Makefile b/Makefile
index f68df780a..81b149a68 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,6 @@
 BINDIR      := $(CURDIR)/bin
 INSTALL_PATH ?= /usr/local/bin
 DIST_DIRS   := find * -type d -exec
-TARGETS     := darwin/amd64 darwin/arm64 linux/amd64 linux/386 linux/arm linux/arm64 linux/loong64 linux/ppc64le linux/s390x linux/riscv64 windows/amd64 windows/arm64
 TARGET_OBJS ?= darwin-amd64.tar.gz darwin-amd64.tar.gz.sha256 darwin-amd64.tar.gz.sha256sum darwin-arm64.tar.gz darwin-arm64.tar.gz.sha256 darwin-arm64.tar.gz.sha256sum linux-amd64.tar.gz linux-amd64.tar.gz.sha256 linux-amd64.tar.gz.sha256sum linux-386.tar.gz linux-386.tar.gz.sha256 linux-386.tar.gz.sha256sum linux-arm.tar.gz linux-arm.tar.gz.sha256 linux-arm.tar.gz.sha256sum linux-arm64.tar.gz linux-arm64.tar.gz.sha256 linux-arm64.tar.gz.sha256sum linux-loong64.tar.gz linux-loong64.tar.gz.sha256 linux-loong64.tar.gz.sha256sum linux-ppc64le.tar.gz linux-ppc64le.tar.gz.sha256 linux-ppc64le.tar.gz.sha256sum linux-s390x.tar.gz linux-s390x.tar.gz.sha256 linux-s390x.tar.gz.sha256sum linux-riscv64.tar.gz linux-riscv64.tar.gz.sha256 linux-riscv64.tar.gz.sha256sum windows-amd64.zip windows-amd64.zip.sha256 windows-amd64.zip.sha256sum windows-arm64.zip windows-arm64.zip.sha256 windows-arm64.zip.sha256sum
 BINNAME     ?= helm
 
@@ -176,20 +175,14 @@ build-cross: $(GORELEASER)
 	LDFLAGS='$(LDFLAGS)' $(GORELEASER) build --snapshot --clean
 
 .PHONY: dist
-dist: LDFLAGS += -extldflags "-static"
-dist: $(GORELEASER)
-	GORELEASER_CURRENT_TAG='$(VERSION)' LDFLAGS='$(LDFLAGS)' $(GORELEASER) build --snapshot --clean
-	@for platform_dir in _dist/*/; do \
-		platform=$$(basename "$$platform_dir"); \
-		{ [ -f "_dist/$$platform/helm" ] || [ -f "_dist/$$platform/helm.exe" ]; } || continue; \
-		cp LICENSE README.md "_dist/$$platform/"; \
-		tar czf "_dist/helm-$(VERSION)-$$platform.tar.gz" -C _dist "$$platform/"; \
-	done
-	@for platform_dir in _dist/windows-*/; do \
-		[ -d "$$platform_dir" ] || continue; \
-		platform=$$(basename "$$platform_dir"); \
-		(cd _dist && zip -r "helm-$(VERSION)-$$platform.zip" "$$platform/"); \
-	done
+dist:
+	( \
+		cd _dist && \
+		$(DIST_DIRS) cp ../LICENSE {} \; && \
+		$(DIST_DIRS) cp ../README.md {} \; && \
+		$(DIST_DIRS) tar -zcf helm-${VERSION}-{}.tar.gz {} \; && \
+		$(DIST_DIRS) zip -r helm-${VERSION}-{}.zip {} \; \
+	)
 
 .PHONY: fetch-dist
 fetch-dist:

From 19b3656306829cae166f484feb4a1319f47844c0 Mon Sep 17 00:00:00 2001
From: George Jenkins <gvjenkins@gmail.com>
Date: Wed, 6 May 2026 10:35:57 -0700
Subject: [PATCH 27/28] Bump to version v4.2 (#32102)

Signed-off-by: George Jenkins <gvjenkins@gmail.com>
---
 internal/version/version.go                  | 2 +-
 pkg/chart/common/capabilities_test.go        | 4 ++--
 pkg/cmd/testdata/output/version-short.txt    | 2 +-
 pkg/cmd/testdata/output/version-template.txt | 2 +-
 pkg/cmd/testdata/output/version.txt          | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/internal/version/version.go b/internal/version/version.go
index 3daf80893..007f79f16 100644
--- a/internal/version/version.go
+++ b/internal/version/version.go
@@ -34,7 +34,7 @@ var (
 	//
 	// Increment major number for new feature additions and behavioral changes.
 	// Increment minor number for bug fixes and performance enhancements.
-	version = "v4.1"
+	version = "v4.2"
 
 	// metadata is extra build time data
 	metadata = ""
diff --git a/pkg/chart/common/capabilities_test.go b/pkg/chart/common/capabilities_test.go
index c9f026cbb..c8d47581c 100644
--- a/pkg/chart/common/capabilities_test.go
+++ b/pkg/chart/common/capabilities_test.go
@@ -60,8 +60,8 @@ func TestDefaultCapabilities(t *testing.T) {
 	}
 
 	hv := caps.HelmVersion
-	if hv.Version != "v4.1" {
-		t.Errorf("Expected default HelmVersion to be v4.1, got %q", hv.Version)
+	if hv.Version != "v4.2" {
+		t.Errorf("Expected default HelmVersion to be v4.2, got %q", hv.Version)
 	}
 }
 
diff --git a/pkg/cmd/testdata/output/version-short.txt b/pkg/cmd/testdata/output/version-short.txt
index 8cf4318fb..2fa2c5705 100644
--- a/pkg/cmd/testdata/output/version-short.txt
+++ b/pkg/cmd/testdata/output/version-short.txt
@@ -1 +1 @@
-v4.1
+v4.2
diff --git a/pkg/cmd/testdata/output/version-template.txt b/pkg/cmd/testdata/output/version-template.txt
index 8fd8b4962..8f2491e54 100644
--- a/pkg/cmd/testdata/output/version-template.txt
+++ b/pkg/cmd/testdata/output/version-template.txt
@@ -1 +1 @@
-Version: v4.1
\ No newline at end of file
+Version: v4.2
\ No newline at end of file
diff --git a/pkg/cmd/testdata/output/version.txt b/pkg/cmd/testdata/output/version.txt
index 1f4cf4d4a..331c6d5e9 100644
--- a/pkg/cmd/testdata/output/version.txt
+++ b/pkg/cmd/testdata/output/version.txt
@@ -1 +1 @@
-version.BuildInfo{Version:"v4.1", GitCommit:"", GitTreeState:"", GoVersion:"", KubeClientVersion:"v1.20"}
+version.BuildInfo{Version:"v4.2", GitCommit:"", GitTreeState:"", GoVersion:"", KubeClientVersion:"v1.20"}

From d9b2716be5fbb3309c3176b0c887d91ffb16c048 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 7 May 2026 21:33:30 +0000
Subject: [PATCH 28/28] chore(deps): bump github/codeql-action from 4.35.3 to
 4.35.4

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/codeql-analysis.yml | 6 +++---
 .github/workflows/scorecards.yml      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 6714fc8de..256d26cc3 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -48,7 +48,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # pinv4.35.3
+      uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # pinv4.35.4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -59,7 +59,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # pinv4.35.3
+      uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # pinv4.35.4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -73,4 +73,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # pinv4.35.3
+      uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # pinv4.35.4
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 5d78ddd61..16a9a8c13 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -64,6 +64,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
         with:
           sarif_file: results.sarif