Feat: add support for persisting ChartSource#32018
Feat: add support for persisting ChartSource#32018iammehrabsandhu wants to merge 3 commits intohelm:mainfrom
Conversation
Signed-off-by: iammehrabsandhu <user.127.888@users.noreply.github.com>
pull-request-size
bot
added
the
size/XS
There was a problem hiding this comment.
Pull request overview
This PR adds support for persisting the chart source information to track where Helm charts originated from. This addresses issue #31999 which highlights the need to record chart provenance for supply chain auditing and verification. However, the implementation is incomplete and will not compile.
Changes:
- Adds a
Sourcefield of type*common.ChartSourceto theReleasestruct in both v1 and v2 release packages - Includes documentation indicating the field is nil for releases created before this field was added
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| pkg/release/v1/release.go | Adds Source field to Release struct for chart source tracking |
| internal/release/v2/release.go | Adds Source field to Release struct for chart source tracking |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: iammehrabsandhu <user.127.888@users.noreply.github.com>
pull-request-size
bot
added
size/M
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Addresses review feedback on ResolvedSource not being populated when OCI charts are served from the local cache. Also adds a fallback for direct oci:// references when --repo is not used. - DownloadTo: populate ResolvedSource on cache-hit path - DownloadToCache: populate ResolvedSource on cache-hit path - LocateChart: add OCI ref fallback when RepoURL is empty Signed-off-by: iammehrabsandhu <user.127.888@users.noreply.github.com>
iammehrabsandhu
changed the title
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
refs #31999
closes #31999
Status
Complete.
What this PR does / why we need it:
Adds a Source field to the Release so you can always trace exactly where a chart came from. We now capture this origin data during download (chart_downloader.go) for both new pulls and cached charts.
The install and upgrade flows (install.go, upgrade.go) safely attach this information to your deployment.
This is a backward-compatible addition that won't break existing cluster releases.