Fix helmfile init failing to update outdated helm plugins with Helm v4 by Copilot · Pull Request #2554 · helmfile/helmfile

Copilot · 2026-04-23T23:40:59Z

helmfile init silently skipped plugin updates when using Helm v4: helm plugin update either fails outright or doesn't work correctly for tarball-installed plugins (notably secrets with the split-plugin architecture introduced in v4.7.0).

Changes

`pkg/helmexec/exec.go`

UpdatePlugin(name) → UpdatePlugin(name, repo, version): Accepts repo URL and version to enable version-aware update logic (parameter renamed path → repo for clarity)
secrets + Helm 4 special case: Mirrors AddPlugin — uninstalls existing secrets/secrets-getter/secrets-post-renderer plugins, then reinstalls via installHelmSecretsV4()
Fallback for all other plugins: When helm plugin update <name> fails, falls back to helm plugin uninstall <name> + helm plugin install <repo> --version <version>; original update error is preserved and both errors are wrapped when reinstall also fails
Added helmSecretsRequiresSplitInstall(version string) bool: Replaces the incorrect string-based version >= "v4.7.0" comparison (breaks at v4.10.0+) in both AddPlugin and UpdatePlugin with proper semver comparison
Added uninstallPlugin(name string): Private helper wrapping helm plugin uninstall; only emits INFO log output on success to avoid surfacing expected uninstall failures as noise

`pkg/app/init.go`

Passes p.repo and p.version to UpdatePlugin

`pkg/app/init_test.go`

TestCheckHelmPlugins_UpdateFailsFallbackToReinstall: verifies update failure triggers uninstall + install for each plugin, and asserts installed plugin versions on disk are ≥ required versions after completion
TestCheckHelmPlugins_UpdateErrorButPluginAtRequiredVersion: verifies that when the fallback install step also fails but the plugin is present at the required version, init warns and continues

`pkg/helmexec/exec_test.go`

Test_helmSecretsRequiresSplitInstall: table-driven tests covering v4.6.9, v4.7.0, v4.8.0, v4.10.0 (double-digit minor regression case), a pre-release, an invalid version string, and empty string
Test_UpdatePlugin_Helm4SecretsUsesUninstallReinstall: verifies that for Helm 4 + secrets + v4.7.0, the update path calls plugin uninstall for each split plugin and plugin install for each tarball without calling plugin update

- UpdatePlugin now handles secrets plugin with Helm 4 by using the split plugin architecture (uninstall old + install via installHelmSecretsV4) - UpdatePlugin falls back to uninstall + reinstall when helm plugin update fails (e.g., with Helm 4 or tarball-installed plugins) - Fix string-based semver comparison for helm-secrets version check in both AddPlugin and UpdatePlugin using proper semver comparison - Add helmSecretsRequiresSplitInstall helper for reuse and correctness - Add tests for update failure fallback scenarios Agent-Logs-Url: https://github.com/helmfile/helmfile/sessions/533f1b1c-dda6-4934-af27-051e4eaa9927 Co-authored-by: yxxhero <[email protected]>

Copilot

Pull request overview

Fixes helmfile init plugin update behavior under Helm v4 by making updates version-aware and adding a reinstall fallback when helm plugin update fails (notably for tarball-installed plugins like helm-secrets with Helm 4’s split-plugin architecture).

Changes:

Extend plugin update logic to accept repo + version and fall back to uninstall+reinstall when helm plugin update fails.
Add proper semver comparison for deciding when Helm 4 requires split installation for helm-secrets (>= 4.7.0).
Add tests covering the update-failure fallback path and the “error but required version present” behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pkg/helmexec/exec.go	Adds semver-based Helm 4 `helm-secrets` split-install detection, a plugin uninstall helper, and enhanced `UpdatePlugin` logic with reinstall fallback.
pkg/app/init.go	Passes plugin repo/version into the new `UpdatePlugin` signature during `helmfile init`.
pkg/app/init_test.go	Adds tests for update failure fallback to reinstall and for tolerating install errors when the required version is still present.

Copilot · 2026-04-24T00:43:57Z

+		helm.logger.Infof("helm plugin update %v failed, falling back to reinstall with version %v", name, version)
+		if uninstallErr := helm.uninstallPlugin(name); uninstallErr != nil {
+			helm.logger.Warnf("Failed to uninstall helm plugin %v: %v", name, uninstallErr)
+		}
+		return helm.AddPlugin(name, path, version)


In the fallback path, the original helm plugin update failure is effectively lost (only a generic log line is emitted and the returned error is whatever AddPlugin returns). This makes it hard to diagnose why update failed vs why reinstall failed. Consider including the original err in the log message and wrapping/joining it with any uninstall/install error returned so callers get full context.

Copilot · 2026-04-24T00:43:58Z

+	h := NewHelmfileInit("helm", &mockInitConfigProvider{force: true}, newTestLogger(), runner)
+	err := h.CheckHelmPlugins()
+	// Should succeed: update failed but fallback reinstall updated the plugin
+	assert.NoError(t, err)
+


This test verifies that update/uninstall/install commands were invoked, but it doesn’t assert that the plugin versions on disk were actually updated to the required versions after CheckHelmPlugins() completes. Adding an assertion that helmexec.GetPluginVersion(...) is >= the required version for each plugin would make the test validate the behavior it describes and avoid false positives if the reinstall doesn’t update plugin.yaml.

yxxhero · 2026-04-24T06:05:06Z

@copilot fix comments

…ion assertions in tests - exec.go: include original update error in fallback log message; wrap both errors (update + reinstall) when reinstall also fails so callers get full context - init_test.go: add semver import and GetPluginVersion assertions after CheckHelmPlugins to verify plugins are at required versions on disk Agent-Logs-Url: https://github.com/helmfile/helmfile/sessions/c784db7d-7d4c-40a0-97f0-a31eb8901cd6 Co-authored-by: yxxhero <[email protected]>

Copilot · 2026-04-24T06:11:13Z

@copilot fix comments

Both reviewer comments addressed in a31ee32:

exec.go fallback error context: The original helm plugin update error is now included in the fallback log message, and when reinstall also fails, both errors are wrapped together with fmt.Errorf("helm plugin update failed (%w) and reinstall also failed: %w", updateErr, reinstallErr).
init_test.go version assertions: TestCheckHelmPlugins_UpdateFailsFallbackToReinstall now calls helmexec.GetPluginVersion() for each plugin after CheckHelmPlugins() and asserts the installed version is ≥ the required version.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

Copilot · 2026-04-24T06:59:11Z

+func (helm *execer) UpdatePlugin(name, path, version string) error {
+	helm.logger.Infof("Updating helm plugin %v", name)
+


The new UpdatePlugin(name, path, version) signature uses path for what is effectively the plugin source/repo URL (as passed from p.repo). Renaming this parameter (and corresponding local variables) to repo/source would reduce confusion, especially since path elsewhere in this file sometimes means a filesystem path.

Copilot · 2026-04-24T06:59:11Z

+	v, err := semver.NewVersion(version)
+	if err != nil {
+		return false
+	}
+	return !v.LessThan(helmSecretsV4SplitMinVersion)


The semver-based split-install decision (helmSecretsRequiresSplitInstall) is a key behavioral change (fixing the v4.10.0+ string-compare bug), but it’s currently untested. Adding focused unit tests in pkg/helmexec/exec_test.go for versions like v4.6.9, v4.7.0, v4.10.0, and a pre-release would help prevent regressions; it would also be valuable to cover the Helm 4 helm-secrets update path that uninstalls the split plugins before reinstalling.

Copilot · 2026-04-24T06:59:11Z

+func (helm *execer) uninstallPlugin(name string) error {
+	helm.logger.Infof("Uninstalling helm plugin %v", name)
+	out, err := helm.exec([]string{"plugin", "uninstall", name}, map[string]string{}, nil)
 	helm.info(out)


uninstallPlugin always logs command output via helm.info(out) even when the caller intends to ignore uninstall errors (e.g., the Helm 4 helm-secrets split uninstall loop). This can surface expected uninstall failures as INFO output and confuse users. Consider only emitting out at INFO when err == nil, and logging output at DEBUG (or not at all) when uninstall fails and the caller treats it as non-fatal.

Suggested change

helm.info(out)

if err == nil {

helm.info(out)

}

yxxhero · 2026-04-24T07:35:21Z

@copilot fix comments

- exec.go: rename UpdatePlugin parameter path→repo for clarity - exec.go: fix uninstallPlugin to only emit INFO log when err == nil - exec_test.go: add Test_helmSecretsRequiresSplitInstall table-driven tests covering v4.6.9, v4.7.0, v4.8.0, v4.10.0, pre-release, invalid and empty - exec_test.go: add Test_UpdatePlugin_Helm4SecretsUsesUninstallReinstall verifying that Helm 4 + secrets uses uninstall+reinstall (not plugin update) Agent-Logs-Url: https://github.com/helmfile/helmfile/sessions/cbd3f8c9-ec7d-4500-b168-cb1c2f7c87bc Co-authored-by: yxxhero <[email protected]>

Copilot · 2026-04-24T07:44:06Z

@copilot fix comments

All three reviewer comments addressed in 6efb12f:

UpdatePlugin parameter rename: path → repo in the function signature and body.
helmSecretsRequiresSplitInstall tests: Added Test_helmSecretsRequiresSplitInstall in pkg/helmexec/exec_test.go covering v4.6.9, v4.7.0, v4.8.0, v4.10.0 (the double-digit minor regression), a pre-release (v4.7.0-beta.1), an invalid version, and empty string. Also added Test_UpdatePlugin_Helm4SecretsUsesUninstallReinstall verifying that the Helm 4 secrets path calls uninstall for all three split plugins and reinstalls via tarballs without calling plugin update.
uninstallPlugin INFO log: Output is now only emitted at INFO when err == nil; on failure the caller logs at Debug/Warn as appropriate.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Copilot · 2026-04-25T00:34:30Z

+					calledOps = append(calledOps, "update:"+args[2])
+					// Simulate helm plugin update failing (as can happen with Helm 4)
+					return nil, helmexec.ExitError{Message: "plugin update failed", Code: 1}
+				case "uninstall":
+					calledOps = append(calledOps, "uninstall:"+args[2])


This test mock assumes args[2] always exists for plugin update/plugin uninstall and will panic with an index-out-of-range if the invoked args ever change (or if a failure occurs before the plugin name is appended). Add len(args) >= 3 guards in the update and uninstall cases (similar to the existing install guard) to keep the test robust.

Suggested change

calledOps = append(calledOps, "update:"+args[2])

// Simulate helm plugin update failing (as can happen with Helm 4)

return nil, helmexec.ExitError{Message: "plugin update failed", Code: 1}

case "uninstall":

calledOps = append(calledOps, "uninstall:"+args[2])

if len(args) >= 3 {

calledOps = append(calledOps, "update:"+args[2])

}

// Simulate helm plugin update failing (as can happen with Helm 4)

return nil, helmexec.ExitError{Message: "plugin update failed", Code: 1}

case "uninstall":

if len(args) >= 3 {

calledOps = append(calledOps, "uninstall:"+args[2])

}

yxxhero · 2026-04-25T00:41:08Z

@copilot fix comments

Agent-Logs-Url: https://github.com/helmfile/helmfile/sessions/ea0f5afc-d52d-473b-b759-853a8f841a26 Co-authored-by: yxxhero <[email protected]>

Copilot · 2026-04-25T00:45:50Z

@copilot fix comments

Fixed in 597696a — added len(args) >= 3 guards before accessing args[2] in both the update and uninstall cases of the test mock, matching the existing guard on the install case.

yxxhero · 2026-04-25T00:51:14Z

+		updateErr := err
+		helm.logger.Infof("helm plugin update %v failed (%v), falling back to reinstall with version %v", name, updateErr, version)
+		if uninstallErr := helm.uninstallPlugin(name); uninstallErr != nil {
+			helm.logger.Warnf("Failed to uninstall helm plugin %v: %v", name, uninstallErr)


@copilot why not return when uninstallErr !=nil?

Fixed in 9f86ea4 — if uninstall fails, we now return immediately with a combined error wrapping both the original update error and the uninstall error, rather than proceeding to a reinstall that would likely fail too.

… fallback Agent-Logs-Url: https://github.com/helmfile/helmfile/sessions/bb9a675c-309d-4b06-83d4-a6fe078dce64 Co-authored-by: yxxhero <[email protected]>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Initial plan

4d744a1

Copilot AI assigned Copilot and yxxhero Apr 23, 2026

Copilot started work on behalf of yxxhero April 23, 2026 23:41 View session

Copilot AI linked an issue Apr 23, 2026 that may be closed by this pull request

helmfile init doesn't update some outdated helm plugins #2548

Closed

Copilot AI changed the title ~~[WIP] Fix helmfile init not updating outdated helm plugins~~ Fix helmfile init failing to update outdated helm plugins with Helm v4 Apr 24, 2026

Copilot finished work on behalf of yxxhero April 24, 2026 00:07

Copilot AI requested a review from yxxhero April 24, 2026 00:07

yxxhero requested a review from Copilot April 24, 2026 00:38

Copilot started reviewing on behalf of yxxhero April 24, 2026 00:39 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

yxxhero marked this pull request as ready for review April 24, 2026 06:04

yxxhero requested review from aditmeno, itscaro, mumoshu, xiaomudk and zhaque44 as code owners April 24, 2026 06:04

Copilot started work on behalf of yxxhero April 24, 2026 06:05 View session

Copilot finished work on behalf of yxxhero April 24, 2026 06:12

aditmeno previously approved these changes Apr 24, 2026

View reviewed changes

yxxhero requested a review from Copilot April 24, 2026 06:54

Copilot started reviewing on behalf of yxxhero April 24, 2026 06:55 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Copilot started work on behalf of yxxhero April 24, 2026 07:35 View session

Copilot AI dismissed aditmeno’s stale review via 6efb12f April 24, 2026 07:43

Copilot finished work on behalf of yxxhero April 24, 2026 07:45

yxxhero requested review from aditmeno and Copilot April 25, 2026 00:31

Copilot started reviewing on behalf of yxxhero April 25, 2026 00:31 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

Copilot started work on behalf of yxxhero April 25, 2026 00:41 View session

Add len(args) >= 3 guards in test mock for plugin update/uninstall cases

597696a

Agent-Logs-Url: https://github.com/helmfile/helmfile/sessions/ea0f5afc-d52d-473b-b759-853a8f841a26 Co-authored-by: yxxhero <[email protected]>

Copilot finished work on behalf of yxxhero April 25, 2026 00:46

yxxhero reviewed Apr 25, 2026

View reviewed changes

Copilot started work on behalf of yxxhero April 25, 2026 00:51 View session

Copilot finished work on behalf of yxxhero April 25, 2026 00:57

Copilot AI requested a review from yxxhero April 25, 2026 00:57

yxxhero requested a review from Copilot April 25, 2026 01:02

Copilot started reviewing on behalf of yxxhero April 25, 2026 01:02 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

xiaomudk approved these changes Apr 25, 2026

View reviewed changes

yxxhero merged commit c57134c into main Apr 25, 2026
20 checks passed

yxxhero deleted the copilot/fix-helmfile-plugin-update branch April 25, 2026 03:04

		func (helm *execer) UpdatePlugin(name, path, version string) error {
		helm.logger.Infof("Updating helm plugin %v", name)

Uh oh!

Uh oh!

Conversation

Copilot AI commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

pkg/helmexec/exec.go

pkg/app/init.go

pkg/app/init_test.go

pkg/helmexec/exec_test.go

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

yxxhero commented Apr 24, 2026

Uh oh!

Copilot AI commented Apr 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

yxxhero commented Apr 24, 2026

Uh oh!

Copilot AI commented Apr 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

yxxhero commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

yxxhero Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Apr 23, 2026 •

edited

Loading

`pkg/helmexec/exec.go`

`pkg/app/init.go`

`pkg/app/init_test.go`

`pkg/helmexec/exec_test.go`