Introduce test.IsTestMode(), backed by a compile-time const seeded by
two mutually-exclusive build-tagged files (test_mode_on.go under
-tags helmtest, test_mode_off.go otherwise). Branches gated on it
dead-code-eliminate in release builds.
Available for any production code path that needs to behave
differently under test. Not yet consumed — internal/version and
pkg/chart/common continue to gate on the KubeVersionMajorTesting /
KubeVersionMinorTesting sentinels seeded by
internal/version/version_helmtest.go.
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
internal/version and pkg/chart/common imported "testing" only to call
testing.Testing(), pulling the testing package and its dependencies
into release binaries.
Replace those checks with exported KubeVersionMajorTesting /
KubeVersionMinorTesting sentinels that default to zero. A new
build-tagged file internal/version/version_helmtest.go seeds them in
init() and only compiles under -tags helmtest.
The Makefile applies -tags helmtest as a baseline so test-unit and
test-coverage work directly or via `make test`. scripts/coverage.sh
passes the tag to its raw `go test` call. CONTRIBUTING.md documents
that contributors running tests outside the Makefile must pass the
tag themselves.
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
Adds the bidichk linter to .golangci.yml to detect dangerous invisible
Unicode characters (ZWSP, bidi controls) in source files during CI.
Fixes#32137
Signed-off-by: Arnav Nagzirkar <arnav.nagzirkar@mail.utoronto.ca>
Upgrades golang.org/x/net from v0.53.0 to v0.55.0 to fix CVE-2026-39821
(GO-2026-5026), where idna.ToASCII/ToUnicode incorrectly accept Punycode-
encoded labels that decode to ASCII-only labels, enabling privilege escalation
via hostname check bypass.
Coordinated x/ upgrade pulled in by the module graph:
- golang.org/x/sys v0.44.0 => v0.45.0
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Helm v4 shipped on 2025-11-17. Mark it as the current stable release
and v3 as support-mode with its end-of-support dates.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
Return the actual error from io.Copy in Digest() instead of nil.
The previous code swallowed the error and returned an empty string
as a valid SHA-256 digest, which could silently break chart
provenance verification.
Also fix encodeRelease() in pkg/storage/driver/util.go:
- Close the gzip writer on the w.Write() error path to avoid
leaking resources.
- Check the error return from gzip.Writer.Close(), which flushes
remaining compressed data and can fail.
Assisted-by: Grok/xAI
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
The comment describing allowed plugin name characters contained three
U+200B (zero-width space) characters around the '_' and '-' literals.
The rendered comment is identical without them; the ZWSP were likely
copy-pasted from a rich-text source.
Downstream impact: every project that vendors helm.sh/helm/v4 and runs
Renovate gets a repo-wide warning on its Dependency Dashboard about
hidden Unicode characters. Renovate scans the whole tree (including
vendor/) for ZWSP/bidi-override codepoints and cannot be told to skip
a path for this specific check. Removing the characters here clears
the warning everywhere downstream.
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Before this change, hooks with `helm.sh/hook: test` but Kind != Pod
(ConfigMap, Secret, ...) led to `helm test --logs` fail with
`unable to get pod <name>`.
Signed-off-by: Gregory Man <man.gregory@gmail.com>
slog.Error on line 157 passes printf-style positional args (%q, %s)
instead of key-value pairs. The slog API treats these as unkeyed
attributes, producing garbled log output.
Two nearby slog.Warn calls wrap fmt.Sprintf unnecessarily. Convert
all three calls to use proper structured key-value arguments.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Assisted-by: Grok/grok-4
Evans Mungai
Terry Howe
Austin Abro
George Jenkins
dependabot[bot]
MrJack
Arnav Nagzirkar
Benoit Tigeot
Sebastien Tardif
Aleksei Sviridkin
Robert Sirchia
Gregory Man
Matheus Pimenta
Kai Tanaka
box4wangjing
Sumit Solanki