Added a compass.yml file to manage this repository as a Compass component

.github/dependabot.yaml

@@ -0,0 +1,38 @@
+version: 2
+
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    labels: ["dependencies"]
+    schedule:
+      interval: "daily"
+    groups:
+      go-deps:
+        patterns:
+          - "*"
+    allow:
+      - dependency-type: "direct"
+    ignore:
+      # Kubernetes deps are updated by fluxcd/pkg/runtime
+      - dependency-name: "k8s.io/*"
+      - dependency-name: "sigs.k8s.io/*"
+      - dependency-name: "github.com/go-logr/*"
+      # jsondiff is updated by fluxcd/pkg/ssa
+      - dependency-name: "github.com/wI2L/jsondiff"
+      # OCI deps are updated by fluxcd/pkg/oci
+      - dependency-name: "github.com/google/go-containerregistry*"
+      - dependency-name: "github.com/opencontainers/*"
+      # Helm deps are updated by fluxcd/pkg/helmtestserver
+      - dependency-name: "helm.sh/helm/*"
+      # Flux APIs are updated at release time
+      - dependency-name: "github.com/fluxcd/helm-controller/api"
+      - dependency-name: "github.com/fluxcd/source-controller/api"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    labels: ["area/ci", "dependencies"]
+    groups:
+      ci:
+        patterns:
+          - "*"
+    schedule:
+      interval: "daily"

.github/labels.yaml

@@ -0,0 +1,27 @@
+# Configuration file to declaratively configure labels
+# Ref: https://github.com/EndBug/label-sync#Config-files
+
+- name: area/drift
+  description: Drift detection/correction related issues and pull requests
+  color: '#ff5c00'
+- name: area/helm
+  description: Helm related issues and pull requests
+  color: '#1673b6'
+- name: area/kustomize
+  description: Kustomize (post-rendering) related issues and pull requests
+  color: '#00e54d'
+- name: area/oci
+  description: OCI related issues and pull requests
+  color: '#c739ff'
+- name: backport:release/v1.0.x
+  description: To be backported to release/v1.0.x
+  color: '#ffd700'
+- name: backport:release/v1.1.x
+  description: To be backported to release/v1.1.x
+  color: '#ffd700'
+- name: backport:release/v1.2.x
+  description: To be backported to release/v1.2.x
+  color: '#ffd700'
+- name: backport:release/v1.3.x
+  description: To be backported to release/v1.3.x
+  color: '#ffd700'

.github/workflows/backport.yaml

@@ -0,0 +1,34 @@
+name: backport
+
+on:
+  pull_request_target:
+    types: [closed, labeled]
+
+permissions:
+  contents: read
+
+jobs:
+  pull-request:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    if: github.event.pull_request.state == 'closed' && github.event.pull_request.merged && (github.event_name != 'labeled' || startsWith('backport:', github.event.label.name))
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Create backport PRs
+        uses: korthout/backport-action@436145e922f9561fc5ea157ff406f21af2d6b363 # v3.2.0
+        # xref: https://github.com/korthout/backport-action#inputs
+        with:
+          # Use token to allow workflows to be triggered for the created PR
+          github_token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          # Match labels with a pattern `backport:<target-branch>`
+          label_pattern: '^backport:([^ ]+)$'
+          # A bit shorter pull-request title than the default
+          pull_title: '[${target_branch}] ${pull_title}'
+          # Simpler PR description than default
+          pull_description: |-
+            Automated backport to `${target_branch}`, triggered by a label in #${pull_number}.

.github/workflows/cifuzz.yaml

@@ -2,7 +2,8 @@ name: fuzz
 on:
   pull_request:
     branches:
-      - main
+      - "main"
+      - "release/**"
 
 permissions:
   contents: read # for actions/checkout to fetch code
@@ -12,17 +13,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Setup Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
-        go-version: 1.19.x
-    - name: Restore Go cache
-      uses: actions/cache@v3
-      with:
-        path: ~/go/pkg/mod
-        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-        restore-keys: |
-          ${{ runner.os }}-go
+        go-version: 1.24.x
+        cache-dependency-path: |
+          **/go.sum
+          **/go.mod
     - name: Smoke test Fuzzers
       run: make fuzz-smoketest

.github/workflows/e2e.yaml

@@ -4,8 +4,8 @@ on:
   pull_request:
   push:
     branches:
-      - main
-      - "feature/**"
+      - "main"
+      - "release/**"
 
 permissions:
   contents: read # for actions/checkout to fetch code
@@ -15,40 +15,35 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v2
-        with:
-          platforms: all
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
       - name: Setup Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
         with:
           buildkitd-flags: "--debug"
-      - name: Restore Go cache
-        uses: actions/cache@v3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
       - name: Cache Docker layers
-        uses: actions/cache@v3
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         id: cache
         with:
           path: /tmp/.buildx-cache
           key: ${{ runner.os }}-buildx-ghcache-${{ github.sha }}
           restore-keys: |
             ${{ runner.os }}-buildx-ghcache-
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
-          go-version: 1.19.x
+          go-version: 1.24.x
+          cache-dependency-path: |
+            **/go.sum
+            **/go.mod
       - name: Setup Kubernetes
-        uses: helm/kind-action@v1.5.0
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
         with:
-          version: v0.17.0
+          version: v0.20.0
           cluster_name: kind
+          node_image: kindest/node:v1.27.3@sha256:3966ac761ae0136263ffdb6cfd4db23ef8a83cba8a463690e98317add2c9ba72
       - name: Setup Helm
         uses: fluxcd/pkg/actions/helm@main
       - name: Setup Kustomize
@@ -96,6 +91,14 @@ jobs:
           kubectl -n helm-system rollout status deploy/helm-controller --timeout=1m
         env:
           KUBEBUILDER_ASSETS: ${{ github.workspace }}/kubebuilder/bin
+      - name: Test samples
+        run: |
+          kubectl create ns samples
+          kubectl -n samples apply -f config/samples
+          kubectl -n samples wait hr/podinfo-ocirepository --for=condition=ready --timeout=4m
+          kubectl -n samples wait hr/podinfo-gitrepository --for=condition=ready --timeout=4m
+          kubectl -n samples wait hr/podinfo-helmrepository --for=condition=ready --timeout=4m
+          kubectl delete ns samples
       - name: Install sources
         run: |
           kubectl -n helm-system apply -f config/testdata/sources
@@ -143,6 +146,16 @@ jobs:
           kubectl -n install-create-target-ns get deployment install-create-target-ns-install-create-target-ns-podinfo
 
           kubectl -n helm-system delete -f config/testdata/install-create-target-ns
+      - name: Run install from helmChart test
+        run: |
+          kubectl -n helm-system apply -f config/testdata/install-from-hc-source
+          kubectl -n helm-system wait helmreleases/podinfo-from-hc --for=condition=ready --timeout=4m
+          kubectl -n helm-system delete -f config/testdata/install-from-hc-source
+      - name: Run install from ocirepo test
+        run: |
+          kubectl -n helm-system apply -f config/testdata/install-from-ocirepo-source
+          kubectl -n helm-system wait helmreleases/podinfo-from-ocirepo --for=condition=ready --timeout=4m
+          kubectl -n helm-system delete -f config/testdata/install-from-ocirepo-source
       - name: Run install fail test
         run: |
           test_name=install-fail
@@ -174,7 +187,7 @@ jobs:
           kubectl -n helm-system apply -f config/testdata/$test_name
           echo -n ">>> Waiting for expected conditions"
           count=0
-          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="False" and .TestSuccess=="False" and .Ready=="False"' )" ]; do
+          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="True" and .TestSuccess=="False" and .Ready=="False"' )" ]; do
             echo -n '.'
             sleep 5
             count=$((count + 1))
@@ -218,7 +231,7 @@ jobs:
           fi
 
           kubectl -n helm-system delete -f config/testdata/$test_name
-      - name: Run install fail with remedition test
+      - name: Run install fail with remediation test
         run: |
           test_name=install-fail-remediate
           kubectl -n helm-system apply -f config/testdata/$test_name
@@ -235,21 +248,22 @@ jobs:
           done
           echo ' done'
 
-          # Ensure release does not exist (was uninstalled).
-          HISTORY=$(helm -n helm-system history $test_name 2>&1; exit 0)
-          if [ "$HISTORY" != 'Error: release: not found' ]; then
-            echo -e "Unexpected release history: $HISTORY"
+          # Ensure release was uninstalled.
+          RELEASE_STATUS=$(helm -n helm-system history $test_name -o json | jq -r 'if length == 1 then .[0].status else empty end')
+          if [ "$RELEASE_STATUS" != "uninstalled" ]; then
+            echo -e "Unexpected release status: $RELEASE_STATUS"
             exit 1
           fi
 
           kubectl -n helm-system delete -f config/testdata/$test_name
+          helm -n helm-system delete $test_name
       - name: Run install fail with retry test
         run: |
           test_name=install-fail-retry
           kubectl -n helm-system apply -f config/testdata/$test_name
           echo -n ">>> Waiting for expected conditions"
           count=0
-          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.installFailures == 2 and ( .status.conditions | map( { (.type): .status } ) | add | .Released=="False" and .Ready=="False" )' )" ]; do
+          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.installFailures == 2 and ( .status.conditions | map( { (.type): .status } ) | add | .Released=="False" and .Ready=="False" and .Stalled=="True" )' )" ]; do
             echo -n '.'
             sleep 5
             count=$((count + 1))
@@ -295,7 +309,7 @@ jobs:
           kubectl -n helm-system apply -f config/testdata/$test_name/upgrade.yaml
           echo -n ">>> Waiting for expected conditions"
           count=0
-          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="False" and .Ready=="False"' )" ]; do
+          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="False" and .Ready=="False" and .Stalled=="True"' )" ]; do
             echo -n '.'
             sleep 5
             count=$((count + 1))
@@ -341,7 +355,7 @@ jobs:
           kubectl -n helm-system apply -f config/testdata/$test_name/upgrade.yaml
           echo -n ">>> Waiting for expected conditions"
           count=0
-          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="False" and .TestSuccess=="False" and .Ready=="False"' )" ]; do
+          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="True" and .TestSuccess=="False" and .Ready=="False" and .Stalled=="True"' )" ]; do
             echo -n '.'
             sleep 5
             count=$((count + 1))
@@ -462,6 +476,45 @@ jobs:
           fi
 
           kubectl delete -n helm-system -f config/testdata/$test_name/install.yaml
+      - name: Run upgrade from ocirepo source
+        run: |
+            test_name=upgrade-from-ocirepo-source
+            kubectl -n helm-system apply -f config/testdata/$test_name/install.yaml
+            echo -n ">>> Waiting for expected conditions"
+            count=0
+            until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="True" and .Ready=="True"' )" ]; do
+              echo -n '.'
+              sleep 5
+              count=$((count + 1))
+              if [[ ${count} -eq 24 ]]; then
+                echo ' No more retries left!'
+                exit 1
+              fi
+            done
+            echo ' done'
+
+            # Validate release was installed.
+            REVISION_COUNT=$(helm -n helm-system history -o json $test_name | jq 'length')
+            if [ "$REVISION_COUNT" != 1 ]; then
+              echo -e "Unexpected revision count: $REVISION_COUNT"
+              exit 1
+            fi
+
+            kubectl -n helm-system apply -f config/testdata/$test_name/upgrade.yaml
+            echo -n ">>> Waiting for expected conditions"
+            count=0
+            until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="True" and .Ready=="True"' )" ]; do
+              echo -n '.'
+              sleep 5
+              count=$((count + 1))
+              if [[ ${count} -eq 24 ]]; then
+                echo ' No more retries left!'
+                exit 1
+              fi
+            done
+            echo ' done'
+
+            kubectl delete -n helm-system -f config/testdata/$test_name/install.yaml
       - name: Run upgrade fail with uninstall remediation strategy test
         run: |
           test_name=upgrade-fail-remediate-uninstall
@@ -536,6 +589,19 @@ jobs:
             fi
           done
           echo ' done'
+      - name: Run delete-ns tests
+        run: |
+          kubectl apply -f config/testdata/delete-ns
+          kubectl -n delete-ns wait helmreleases/podinfo --for=condition=ready --timeout=2m
+          kubectl delete ns delete-ns 1>/dev/null 2>&1 &
+          echo -n ">>> Waiting for namespace to be deleted"
+          if kubectl wait --for=delete namespace delete-ns --timeout=5m; then
+            echo ' Namespace deleted successfully'
+          else
+            echo ' Timed out waiting for namespace to be deleted'
+            kubectl get all -n delete-ns
+            exit 1
+          fi
       - name: Run post-renderer-kustomize test
         run: |
           kubectl -n helm-system apply -f config/testdata/post-renderer-kustomize
@@ -551,7 +617,7 @@ jobs:
             exit 1
           fi
           kubectl -n helm-system delete -f config/testdata/post-renderer-kustomize
-      - name: Boostrap CRDs Upgrade Tests
+      - name: Bootstrap CRDs Upgrade Tests
         if: ${{ startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/heads/') }}
         run: |
           REF=${{ github.ref }}

.github/workflows/nightly.yaml

@@ -14,18 +14,17 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v2
-        with:
-          platforms: all
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
       - name: Setup Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
         with:
           buildkitd-flags: "--debug"
       - name: Build multi-arch container image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0 # v6.17.0
         with:
           push: false
           builder: ${{ steps.buildx.outputs.name }}