From 829ef9fa25da8ef8dc2aa6cf5d284595846a1553 Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Wed, 19 Aug 2026 18:32:31 +0200 Subject: [PATCH] :wrench: chore(ci): put every Helm pin on v3.21.4 Renovate bumped the azure/setup-helm input in release.yaml to v3.21.4 while the annotated HELM_VERSION pins stayed on v3.17.3, so the release would have packaged, pushed and signed the chart with a Helm four minor versions ahead of anything CI ever ran. release.yaml parses `helm push` output to extract the chart digest, so a format change there fails the release -- loudly, since the step exits non-zero, but only at release time. Aligns ci.yaml (x2), kind-e2e-setup, hack/install-helm.sh and Taskfile.yml to v3.21.4 so CI exercises the version the release actually uses. Also groups the pins so this cannot recur: the setup-helm input is seen by the github-actions manager and the annotated pins by the custom manager, putting them in different renovate groups. Both resolve to depName helm/helm, so a matchDepNames rule keeps them in one PR from now on. --- .github/actions/kind-e2e-setup/action.yml | 2 +- .github/workflows/ci.yaml | 4 ++-- Taskfile.yml | 2 +- hack/install-helm.sh | 4 ++-- renovate.json | 5 +++++ 5 files changed, 11 insertions(+), 6 deletions(-) diff --git a/.github/actions/kind-e2e-setup/action.yml b/.github/actions/kind-e2e-setup/action.yml index 97c058fe..d1dcd0f4 100644 --- a/.github/actions/kind-e2e-setup/action.yml +++ b/.github/actions/kind-e2e-setup/action.yml @@ -54,7 +54,7 @@ runs: - name: Install kind and helm shell: bash env: - HELM_VERSION: v3.17.3 + HELM_VERSION: v3.21.4 run: | set -euo pipefail mkdir -p ~/.cache/kind diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index c4377fd4..0d02ee74 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -128,7 +128,7 @@ jobs: run: bash hack/test/demo_04_samples_kustomize_test.sh - name: Install Helm env: - HELM_VERSION: v3.17.3 + HELM_VERSION: v3.21.4 run: bash hack/install-helm.sh - name: Ensure yq is available run: | @@ -279,7 +279,7 @@ jobs: version: 3.51.1 - name: Install Helm env: - HELM_VERSION: v3.17.3 + HELM_VERSION: v3.21.4 run: bash hack/install-helm.sh - name: Install helm-unittest plugin run: helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.5.1 diff --git a/Taskfile.yml b/Taskfile.yml index a5b88531..7a99a10f 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -26,7 +26,7 @@ vars: # renovate: datasource=github-releases depName=fe3dback/go-arch-lint GO_ARCH_LINT_VERSION: v1.15.0 # renovate: datasource=github-releases depName=helm/helm - HELM_VERSION: v3.17.3 + HELM_VERSION: v3.21.4 # renovate: datasource=github-releases depName=norwoodj/helm-docs HELM_DOCS_VERSION: v1.14.2 HELM_DOCS_BIN: "{{.BIN_DIR}}/helm-docs" diff --git a/hack/install-helm.sh b/hack/install-helm.sh index d5161c77..119265f5 100755 --- a/hack/install-helm.sh +++ b/hack/install-helm.sh @@ -1,10 +1,10 @@ #!/usr/bin/env bash # Install a pinned Helm 3 release with SHA256-verified tarball download. # Checksums from https://get.helm.sh/helm-${VERSION}-${OS}-${ARCH}.tar.gz.sha256 -# Usage: HELM_VERSION=v3.17.3 hack/install-helm.sh +# Usage: HELM_VERSION=v3.21.4 hack/install-helm.sh set -euo pipefail -VERSION="${HELM_VERSION:-v3.17.3}" +VERSION="${HELM_VERSION:-v3.21.4}" OS="$(uname -s | tr '[:upper:]' '[:lower:]')" ARCH="$(uname -m)" diff --git a/renovate.json b/renovate.json index 2c8c5ab4..0e40c1fa 100644 --- a/renovate.json +++ b/renovate.json @@ -110,6 +110,11 @@ { "matchManagers": ["custom.regex"], "groupName": "pinned build tools" + }, + { + "description": "Keep every Helm pin on one version. The azure/setup-helm input in release.yaml is seen by the github-actions manager while the annotated HELM_VERSION pins are seen by the custom manager, so without this they land in different groups and drift apart -- which is exactly how release.yaml reached v3.21.4 while CI stayed on v3.17.3. Both resolve to depName helm/helm.", + "matchDepNames": ["helm/helm"], + "groupName": "helm" } ] }