From 5a30c7ae8504218fd68d87c5a7d929d0a3bb3891 Mon Sep 17 00:00:00 2001
From: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
Date: Sun, 12 Jul 2026 23:00:17 -0500
Subject: [PATCH] fix(scripts): add cache-busting to get-helm-3 version check

The get-helm-3 script queries get.helm.sh/helm3-latest-version to
determine the latest release. The CDN serving this file has no
Cache-Control header, so edge servers can serve stale cached
responses for hours after a new release.

This causes non-deterministic behavior: machines running get-helm-3
at the same time can install different versions depending on which
CDN edge node they hit.

Fix: Append a timestamp query string (?ts=1783837438) to bust CDN
caches, and add Cache-Control: no-cache header to both curl and wget
requests.

Fixes #32329

Signed-off-by: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
---
 scripts/get-helm-3 | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/scripts/get-helm-3 b/scripts/get-helm-3
index 5f265a52f..dad66ab20 100755
--- a/scripts/get-helm-3
+++ b/scripts/get-helm-3
@@ -114,12 +114,14 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
-    local latest_release_url="https://get.helm.sh/helm3-latest-version"
+    # Append a cache-busting query string to avoid CDN edge servers
+    # serving stale version files after a new release.
+    local latest_release_url="https://get.helm.sh/helm3-latest-version?ts=$(date +%s)"
     local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
-      latest_release_response=$( curl -L --silent --show-error --fail "$latest_release_url" 2>&1 || true )
+      latest_release_response=$( curl -L --silent --show-error --fail -H "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
     elif [ "${HAS_WGET}" == "true" ]; then
-      latest_release_response=$( wget "$latest_release_url" -q -O - 2>&1 || true )
+      latest_release_response=$( wget "$latest_release_url" --header="Cache-Control: no-cache" -q -O - 2>&1 || true )
     fi
     TAG=$( echo "$latest_release_response" | grep '^v[0-9]' )
     if [ "x$TAG" == "x" ]; then