Summary

Post #1032 + #1035, the argocd-helm contract is --set repoURL=oci://<registry>/<path> (parent namespace, with oci:// scheme), and the parent App template appends .Chart.Name itself via the separate source.chart field. The bundler templates the user-supplied --set repoURL=… value verbatim into both spec.source.repoURL and spec.source.helm.valuesObject.repoURL on the parent aicr-stack Application — oci:// scheme included.

In our test against ArgoCD v3.4.2 + a real OCI registry, the repo-server rejected the prefixed shape: it appears to treat oci://-prefixed repoURL as a generic OCI artifact and resolves HEAD /v2/<path>/manifests/<tag> with no chart segment, instead of the Helm OCI shape HEAD /v2/<path>/<chart>/manifests/<tag> you'd expect when source.chart is set. The Argo CD OCI Helm docs explicitly call out that oci:// is not included on repoURL for Helm OCI sources (repoURL: registry-1.docker.io/bitnamicharts).

If that's the canonical Argo contract, then the contract introduced in #1032's required message + README ("pass --set repoURL=oci://<registry>/<path>") emits an oci://-prefixed repoURL into the rendered Application that real Argo CD then rejects. The existing test surface doesn't catch this because every regression test (TestHelmTemplate_*) is a local helm template render that never hits a real Argo repo-server.

Test caveat: aicr commit 8b4939 (2026-05-20), predates #1032/#1035/#1036/#1038/#1039. Rebuild from main is in progress and we'll follow up. Filing now because none of the merged fixes touch oci:// scheme handling, so this should still reproduce post-fix. Close out if it doesn't.

Environment

• ArgoCD: quay.io/argoproj/argocd:v3.4.2
• Registry: private OCI registry serving Helm-format artifacts
• Cluster: EKS GB200, Ubuntu 24.04

Reproduction

aicr bundle --recipe recipe.yaml --deployer argocd-helm \
  --output oci://<registry>/<org>/<path>/aicr-bundle:<tag>

# Per the bundler's own `required` message:
helm install <release> oci://<registry>/<org>/<path>/aicr-bundle:<tag> \
  --namespace argocd \
  --set repoURL=oci://<registry>/<org>/<path>

Generated aicr-stack Application:

spec:
  source:
    repoURL: oci://<registry>/<org>/<path>   # oci:// from --set, templated verbatim
    chart: aicr-bundle
    targetRevision: <tag>
    helm:
      valuesObject:
        repoURL: oci://<registry>/<org>/<path>

ArgoCD repo-server:

Failed to load target state: ... HEAD "https://<registry>/v2/<org>/<path>/manifests/<tag>": response status code 401: Unauthorized

URL omits aicr-bundle; should be …/<org>/<path>/aicr-bundle/manifests/<tag>.

Workaround

kubectl patch application aicr-stack -n argocd --type=json -p='[
  {"op":"replace","path":"/spec/source/repoURL","value":"<registry>/<org>/<path>"},
  {"op":"replace","path":"/spec/source/helm/valuesObject/repoURL","value":"<registry>/<org>/<path>"}
]'

Sync succeeds immediately.

Suggested fix

Strip oci:// inside the bundler before templating Application repoURL fields, and drop the oci:// from the required message + docstring + README + cli-reference.md examples. Matches the Argo OCI Helm contract.

Related

• fix(bundler): derive argocd-helm chart name from OCI artifact path #1032 — introduced the contract this issue is about (--set repoURL=oci://<registry>/<path>, parent App appends .Chart.Name). Fix is correct in shape; the oci:// scheme is what real Argo CD rejects when used in source.repoURL for a Helm OCI source.
• fix(bundler): fix bugs - assemble full OCI artifact in path-based child apps; quote chart name (#1034) #1035 — reinforces the post-fix(bundler): derive argocd-helm chart name from OCI artifact path #1032 contract for path-based child apps (/{{ .Chart.Name }} append). Same scheme caveat applies to the child apps if a real Argo CD treats oci:// differently for generic-OCI sources.
• fix(bundler): tolerate trailing slash on repoURL; quote Chart.yaml version #1038 — added trimSuffix "/" on repoURL (trailing-slash robustness); did not address scheme.
• fix(bundler): pin OCI sync for argocd-helm mixed-component -pre/-post children #1039 — added TestHelmTemplate_MixedComponentPreChildResolvesFromOCI regression test; same caveat as above (local helm template, not real Argo CD).
• fix(kwok): drop recipe suffix from argocd-helm-oci in-cluster repoURL #1047 — KWOK wrapper-script fix (later reverted); KWOK CI hasn't validated the post-fix(bundler): derive argocd-helm chart name from OCI artifact path #1032 contract end-to-end yet, so real-cluster behavior of oci://-prefixed repoURL isn't covered by CI.
• bug(bundler): argocd-helm generates gpu-operator-pre Application with path instead of chart — blocks OCI sync #1018, bug(bundler): argocd-helm repoURL UX — surface in values.yaml and emit OCI install hint #1020 — sibling argocd-helm UX issues; don't cover scheme handling.