fix: refresh Chart.lock after rewriting file:// dependencies by sstarcher · Pull Request #2587 · helmfile/helmfile

sstarcher · 2026-05-13T18:44:30Z

rewriteChartDependencies rewrites relative file:// repository URLs in Chart.yaml to absolute paths so chartify can resolve them from a temp directory. That mutates the Chart.yaml dependencies block, which invalidates the Chart.lock digest (helm computes it as sha256(json.Marshal([2][]Dependency{req, lock})) over the dependencies).

Once the lock is out of sync, downstream helm dependency build errors with "the lock file (Chart.lock) is out of sync with the dependencies file (Chart.yaml)" and chartify falls back to helm dependency update. dep update then re-resolves Chart.yaml's version constraints against the chart repo, so any constraint that admits newer versions (e.g. version: "*", ~1.0) silently picks up a newer dependency on every render — even though Chart.lock pins a specific version.

Repro:

Chart.yaml has version: "*" for some-dep, Chart.lock pins 4.1.0, upstream now publishes 4.2.0.
helm template . honors the cached charts/some-dep-4.1.0.tgz.
helmfile template produces 4.2.0, because it triggered chartify (via jsonPatches/strategic-merge/kustomize/etc), which copied the chart, ran dep up, and re-resolved the wildcard.

This commit refreshes Chart.lock alongside Chart.yaml in the temp copy:

Mirror the rewritten file:// repository URLs onto matching entries in Chart.lock's dependencies. Without this, helm dep build would resolve the lock's relative file:// paths against the temp chart directory and fail with "directory ... not found".
Recompute the digest using helm's resolver.HashReq algorithm (sha256(json.Marshal([2][]chart.Dependency{req, lock}))). The algorithm is small and stable; resolver.HashReq itself lives in an internal package, so it's inlined here.
Locked versions are preserved verbatim — only the repository URL is updated and the digest recomputed. Chart.lock remains the source of truth for which versions get installed.

Copilot

Pull request overview

This PR updates Helmfile’s chart dependency rewrite flow to keep Chart.lock consistent after rewriting relative file:// dependency repositories in Chart.yaml to absolute paths (used by chartify’s temp directory workflow). The goal is to avoid triggering helm dependency update due to an out-of-sync lock digest, which can unintentionally re-resolve version constraints and change rendered dependencies.

Changes:

Refresh Chart.lock in the temporary chart copy by mirroring rewritten file:// repository URLs and recomputing the lock digest.
Inline Helm’s digest algorithm (JSON marshal → sha256) to avoid importing Helm’s internal resolver package.
Add a unit test asserting Chart.lock digest changes and file:// repository URLs are rewritten in the temp copy.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
pkg/state/state.go	Updates `rewriteChartDependencies` to also rewrite matching `Chart.lock` entries and recompute the lock digest.
pkg/state/chart_dependencies_rewrite_test.go	Adds a unit test verifying the temp copy’s `Chart.lock` is refreshed when `Chart.yaml` is rewritten.

yxxhero · 2026-05-18T00:22:26Z

@sstarcher here. could you bump charity to v0.26.4?

`rewriteChartDependencies` rewrites relative `file://` repository URLs in Chart.yaml to absolute paths so chartify can resolve them from a temp directory. That mutates the Chart.yaml dependencies block, which invalidates the Chart.lock digest (helm computes it as `sha256(json.Marshal([2][]Dependency{req, lock}))` over the dependencies). Once the lock is out of sync, downstream `helm dependency build` errors with "the lock file (Chart.lock) is out of sync with the dependencies file (Chart.yaml)" and chartify falls back to `helm dependency update`. `dep update` then re-resolves Chart.yaml's version constraints against the chart repo, so any constraint that admits newer versions (e.g. `version: "*"`, `~1.0`) silently picks up a newer dependency on every render — even though Chart.lock pins a specific version. Repro: - Chart.yaml has `version: "*"` for some-dep, Chart.lock pins 4.1.0, upstream now publishes 4.2.0. - `helm template .` honors the cached `charts/some-dep-4.1.0.tgz`. - `helmfile template` produces 4.2.0, because it triggered chartify (via jsonPatches/strategic-merge/kustomize/etc), which copied the chart, ran `dep build` against an out-of-sync lock, fell back to `dep up`, and re-resolved the wildcard. This commit refreshes Chart.lock alongside Chart.yaml in the temp copy: - Mirror the rewritten file:// repository URLs onto matching entries in Chart.lock's dependencies. Without this, `helm dep build` would resolve the lock's relative `file://` paths against the temp chart directory and fail with "directory ... not found". - Recompute the digest using helm's resolver.HashReq algorithm (`sha256(json.Marshal([2][]chart.Dependency{req, lock}))`). The algorithm is small and stable; resolver.HashReq itself lives in an internal package, so it's inlined here. - Locked versions are preserved verbatim — only the repository URL is updated and the digest recomputed. Chart.lock remains the source of truth for which versions get installed. - The original Chart.lock on disk is never modified; only the temp copy is rewritten. Adds TestRewriteChartDependencies_RefreshesChartLock covering digest recomputation, file:// URL mirroring, version preservation, untouched non-file:// deps, and original-on-disk integrity. Signed-off-by: Shane Starcher <[email protected]>

- Map all helm Dependency fields (alias, condition, tags, import-values, enabled) when building the request slice for digest computation, not just name/version/repository. This ensures the recomputed digest matches Helm's resolver.HashReq for all dependency shapes. - Match lock entries by Name + Alias (not Name alone) to correctly handle charts with duplicate dependency names distinguished by alias. - Log a warning when reading Chart.lock fails with a non-NotExist error, while still treating a missing Chart.lock as expected. - Add test case exercising dependencies with alias, condition, tags, and import-values fields, including same-name deps disambiguated by alias. Co-Authored-By: Claude Opus 4.6 <[email protected]> Signed-off-by: Shane Starcher <[email protected]>

Co-Authored-By: Claude Opus 4.6 <[email protected]> Signed-off-by: Shane Starcher <[email protected]>

yxxhero · 2026-05-18T00:30:12Z

@sstarcher fix DCO.

Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

yxxhero · 2026-05-18T00:40:30Z

@sstarcher fix comments.

…erage - Normalize import-values using maputil.RecursivelyStringifyMapKey before assigning to helmchart.Dependency.ImportValues. When go-yaml v2 decodes nested maps (e.g. import-values entries with child/parent keys), they become map[interface{}]interface{} which json.Marshal cannot encode. This would silently prevent Chart.lock rewriting. The normalization converts all map keys to strings, making the value JSON-safe. - Improve TestRewriteChartDependencies_RefreshesChartLockWithExtraFields to prove that extra fields (condition, tags, import-values) actually affect the computed digest by comparing digests with and without those fields and asserting they differ. Signed-off-by: Shane Starcher <[email protected]> Co-Authored-By: Claude Opus 4.6 <[email protected]>

Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

yxxhero · 2026-05-18T08:54:04Z

@sstarcher oh. new comments.

- Normalize lock.Dependencies ImportValues via RecursivelyStringifyMapKey before json.Marshal, preventing failures when go-yaml v2 decodes nested maps as map[interface{}]interface{}. - Fix TestRewriteChartDependencies_RefreshesChartLockWithExtraFields to use a shared root directory so both chart variants resolve file:// paths to the same absolute location, isolating digest differences to field content. - Add TestRewriteChartDependencies_GoYamlV2ImportValues exercising the HELMFILE_GO_YAML_V3=false path with import-values containing nested maps. Co-Authored-By: Claude Opus 4.6 <[email protected]> Signed-off-by: Shane Starcher <[email protected]>

Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

Add TestRewriteChartDependencies_DigestMatchesHelmHashReq which computes the expected digest independently using the same algorithm as Helm's resolver.HashReq and asserts the rewritten Chart.lock matches exactly. This guards against producing a digest that is "different" yet still rejected by `helm dependency build`. Co-Authored-By: Claude Opus 4.6 <[email protected]> Signed-off-by: Shane Starcher <[email protected]>

Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

sstarcher requested review from aditmeno, itscaro, mumoshu, xiaomudk, yxxhero and zhaque44 as code owners May 13, 2026 18:44

sstarcher changed the title ~~fix: refresh Chart.lock after rewriting file:// dependencies~~ WIP - fix: refresh Chart.lock after rewriting file:// dependencies May 13, 2026

sstarcher force-pushed the refresh-chart-lock-after-rewrite branch from 6482126 to 0cfa87d Compare May 13, 2026 18:52

sstarcher changed the title ~~WIP - fix: refresh Chart.lock after rewriting file:// dependencies~~ fix: refresh Chart.lock after rewriting file:// dependencies May 13, 2026

sstarcher mentioned this pull request May 13, 2026

Prefer helm dependency build over dependency up when Chart.lock exists helmfile/chartify#185

Merged

sstarcher force-pushed the refresh-chart-lock-after-rewrite branch 3 times, most recently from 756178a to e002a02 Compare May 13, 2026 21:20

yxxhero requested a review from Copilot May 13, 2026 22:49

Copilot started reviewing on behalf of yxxhero May 13, 2026 22:50 View session

Copilot AI reviewed May 13, 2026

View reviewed changes

Comment thread pkg/state/state.go Outdated

Comment thread pkg/state/state.go

Comment thread pkg/state/state.go

Comment thread pkg/state/chart_dependencies_rewrite_test.go

yxxhero force-pushed the refresh-chart-lock-after-rewrite branch from e002a02 to 6205fd9 Compare May 18, 2026 00:22

Shane Starcher added 3 commits May 18, 2026 00:25

build(deps): bump github.com/helmfile/chartify to v0.26.4

a3ba618

Co-Authored-By: Claude Opus 4.6 <[email protected]> Signed-off-by: Shane Starcher <[email protected]>

sstarcher force-pushed the refresh-chart-lock-after-rewrite branch from 6205fd9 to 5e1b14f Compare May 18, 2026 00:28

yxxhero requested a review from Copilot May 18, 2026 00:30

Copilot started reviewing on behalf of yxxhero May 18, 2026 00:31 View session

sstarcher force-pushed the refresh-chart-lock-after-rewrite branch from 5e1b14f to a3ba618 Compare May 18, 2026 00:33

Copilot AI reviewed May 18, 2026

View reviewed changes

Comment thread pkg/state/state.go

Comment thread pkg/state/chart_dependencies_rewrite_test.go

sstarcher force-pushed the refresh-chart-lock-after-rewrite branch from e281734 to b14b9c8 Compare May 18, 2026 01:03

yxxhero requested a review from Copilot May 18, 2026 02:57

Copilot started reviewing on behalf of yxxhero May 18, 2026 02:58 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

Comment thread pkg/state/state.go

Comment thread pkg/state/chart_dependencies_rewrite_test.go

sstarcher force-pushed the refresh-chart-lock-after-rewrite branch from a883b5f to 455eefd Compare May 18, 2026 12:43

yxxhero requested a review from Copilot May 18, 2026 14:00

Copilot started reviewing on behalf of yxxhero May 18, 2026 14:00 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

Comment thread pkg/state/chart_dependencies_rewrite_test.go

yxxhero requested a review from Copilot May 18, 2026 14:14

Copilot started reviewing on behalf of yxxhero May 18, 2026 14:14 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

yxxhero approved these changes May 18, 2026

View reviewed changes

yxxhero merged commit 23802e7 into helmfile:main May 18, 2026
20 checks passed

Uh oh!

Uh oh!

Conversation

sstarcher commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yxxhero commented May 18, 2026

Uh oh!

yxxhero commented May 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

yxxhero commented May 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

yxxhero commented May 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sstarcher commented May 13, 2026 •

edited

Loading