Summary

Scope helmfile disableValidation: true to the primary release in a folder group; do not propagate it to the local-helm -pre/-post wrappers.

Motivation / Context

The HasSelfRefCRDs registry flag (added in #914 for charts whose templates reference CRDs the chart itself installs) was being applied to every release sharing a parent component. The wrappers are local-helm raw-manifest charts with no crds/ directory and no self-references, so inheriting the flag silently suppressed helm-diff's mapper sanity check on resources where it is still valuable.

Fixes: #929
Related: #914

Type of Change

• Bug fix (non-breaking change that fixes an issue)

Component(s) Affected

• Bundlers (pkg/bundler, pkg/component/*)

Implementation Notes

• In pkg/bundler/deployer/helmfile/releases.go, the gate is now if f.Name == f.Parent && flags[f.Parent].HasSelfRefCRDs — the f.Name == f.Parent predicate is the canonical "is this the primary release for this component" check in the localformat folder model. Wrappers append -pre/-post to Name while keeping Parent as the component name.
• Comment on the DisableValidation field on Release was updated to record the scoping and reference both issues.

Testing

go test ./pkg/bundler/deployer/helmfile/
golangci-lint run -c .golangci.yaml ./pkg/bundler/deployer/helmfile/...

• Added TestBuildHelmfile_DisableValidationPrimaryOnly with a pre + primary (KindUpstreamHelm) + post layout. Asserts DisableValidation is false on the wrappers and true only on the primary.
• Regenerated the mixed_gpu_operator golden via go test ./pkg/bundler/deployer/helmfile/ -run TestGenerate_Scenarios -update. Diff: one line removed (disableValidation: true on gpu-operator-post).
• Full package suite passes; lint reports 0 issues.

Risk Assessment

• Low — Isolated change, well-tested, easy to revert

Rollout notes: Behavioral change is limited to bundles whose primary component has HasSelfRefCRDs: true AND ships wrappers — today this is gpu-operator only. Operators previously saw disableValidation: true on the post wrapper for gpu-operator; the new output removes it, restoring the mapper check on the wrapper's plain manifests. No registry / values / docs change.

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed (N/A — internal field comment only)
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)