⬆️ chore(deps): update helm to v4

.github/actions/kind-e2e-setup/action.yml

@@ -78,7 +78,7 @@ runs:
     - name: Install kind and helm
       shell: bash
       env:
-        HELM_VERSION: v3.22.1
+        HELM_VERSION: v4.3.1
       run: |
         set -euo pipefail
         source "${GITHUB_WORKSPACE}/hack/lib/fetch.sh"

.github/workflows/ci.yaml

@@ -342,7 +342,7 @@ jobs:
         run: bash hack/test/ci_install_helm_hardening_test.sh
       - name: Install Helm
         env:
-          HELM_VERSION: v3.22.1
+          HELM_VERSION: v4.3.1
         run: bash hack/install-helm.sh
       - name: Ensure yq is available
         run: |
@@ -835,10 +835,10 @@ jobs:
           version: 3.54.0
       - name: Install Helm
         env:
-          HELM_VERSION: v3.22.1
+          HELM_VERSION: v4.3.1
         run: bash hack/install-helm.sh
       - name: Install helm-unittest plugin
-        run: helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.5.1
+        run: task tools:helm-unittest
       - name: Helm lint and unittest
         run: task helm-test
 

.github/workflows/release.yaml

@@ -157,7 +157,7 @@ jobs:
 
       - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
-          version: v3.22.1
+          version: v4.3.1
 
       - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 

Taskfile.yml

@@ -32,10 +32,12 @@ vars:
   # renovate: datasource=go depName=github.com/go-gremlins/gremlins
   GREMLINS_VERSION: v0.6.0
   # renovate: datasource=github-releases depName=helm/helm
-  HELM_VERSION: v3.22.1
+  HELM_VERSION: v4.3.1
   # renovate: datasource=github-releases depName=norwoodj/helm-docs
   HELM_DOCS_VERSION: v1.14.2
   HELM_DOCS_BIN: "{{.BIN_DIR}}/helm-docs"
+  # renovate: datasource=github-releases depName=helm-unittest/helm-unittest
+  HELM_UNITTEST_VERSION: v1.2.1
   COVERAGE_MIN: "90"
   MANAGER_BINARY: "{{.BIN_DIR}}/manager"
   PIPELINE_BINARY: "{{.BIN_DIR}}/kollect-pipeline"
@@ -434,6 +436,11 @@ tasks:
     cmds:
       - bash hack/install-helm-docs.sh {{.HELM_DOCS_VERSION}} {{.HELM_DOCS_BIN}}
 
+  tools:helm-unittest:
+    desc: Install the pinned helm-unittest plugin ({{.HELM_UNITTEST_VERSION}}) into helm's plugin dir
+    cmds:
+      - bash hack/install-helm-unittest.sh {{.HELM_UNITTEST_VERSION}}
+
   helm-docs:
     desc: Regenerate charts/kollect/README.md from values.yaml
     deps: [tools:helm-docs]

docs/development/setup.md

@@ -347,6 +347,7 @@ task vulncheck     # govulncheck (CI vulncheck job)
 task format        # go fmt ./...
 task format:check  # fail if gofmt or goimports would change files
 task helm-test     # helm lint + helm-docs drift + unittest
+task tools:helm-unittest  # install the pinned helm-unittest plugin (CI does the same)
 task helm-docs     # regenerate charts/kollect/README.md
 task lint:markdown # markdownlint-cli2 on docs/**/*.md
 ```

hack/install-helm-unittest.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# Install a pinned helm-unittest plugin release with SHA256-verified tarball download.
+# Usage: hack/install-helm-unittest.sh <version>   (e.g. `task tools:helm-unittest`)
+#
+# WHY NOT `helm plugin install <git url> --version ...`: Helm 4 verifies plugin provenance by
+# default and a git source cannot be verified, so that form now fails with "plugin source does not
+# support verification". Upstream's answer is `--verify=false`, which leaves the git-clone install
+# hook to download the binary and check it against a checksum file fetched without retry or
+# protocol pinning. Instead this script fetches the per-platform release tarball through the
+# shared hardened helper (hack/lib/fetch.sh), verifies its SHA256 against the release's checksum
+# file -- the same trust model as every other hack/install-*.sh -- and unpacks it straight into
+# Helm's plugin directory. The tarball is a complete plugin (plugin.yaml + binary), so no install
+# hook runs and nothing is downloaded after verification. Helm's own GPG provenance check is not
+# used: it needs the maintainer's public key in a legacy keyring, which this repo does not pin.
+# Works unchanged under Helm 3 and Helm 4 (no `helm plugin install` flag differences involved).
+set -euo pipefail
+
+VERSION="${1:?version required (e.g. the Taskfile HELM_UNITTEST_VERSION)}"
+VER="${VERSION#v}"
+
+case "$(uname -m)" in
+  x86_64) arch=amd64 ;;
+  aarch64 | arm64) arch=arm64 ;;
+  *)
+    echo "unsupported architecture: $(uname -m)" >&2
+    exit 1
+    ;;
+esac
+
+case "$(uname -s)" in
+  Linux) os=linux ;;
+  Darwin) os=macos ;;
+  *)
+    echo "unsupported OS: $(uname -s)" >&2
+    exit 1
+    ;;
+esac
+
+command -v helm >/dev/null 2>&1 || {
+  echo "helm is not on PATH; install it first (hack/install-helm.sh)" >&2
+  exit 1
+}
+
+asset="helm-unittest-${os}-${arch}-${VER}.tgz"
+base_url="https://github.com/helm-unittest/helm-unittest/releases/download/v${VER}"
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "${root}/hack/lib/verify-sha256.sh"
+source "${root}/hack/lib/fetch.sh"
+
+plugins_dir="$(helm env HELM_PLUGINS)"
+if [[ -z "${plugins_dir}" ]]; then
+  echo "helm env HELM_PLUGINS returned nothing; cannot locate the plugin directory" >&2
+  exit 1
+fi
+
+installed="$(helm plugin list 2>/dev/null | awk '$1 == "unittest" {print $2}')"
+if [[ "${installed}" == "${VER}" ]]; then
+  echo "helm-unittest ${VER} already installed"
+  exit 0
+fi
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "${tmpdir}"' EXIT
+
+# helm-unittest-checksum.sha lines read `<sha256> *./_dist/<asset>`.
+fetch_to "${base_url}/helm-unittest-checksum.sha" "${tmpdir}/checksum.sha" "helm-unittest ${VERSION} checksums"
+expected="$(awk -v file="./_dist/${asset}" '$2 == "*" file || $2 == file {print $1}' "${tmpdir}/checksum.sha")"
+if [[ ! "${expected}" =~ ^[0-9a-f]{64}$ ]]; then
+  echo "failed to resolve a checksum for ${asset} from ${base_url}/helm-unittest-checksum.sha" >&2
+  exit 1
+fi
+fetch_to "${base_url}/${asset}" "${tmpdir}/${asset}" "helm-unittest ${VERSION} tarball"
+verify_sha256 "${tmpdir}/${asset}" "${expected}"
+
+mkdir -p "${tmpdir}/plugin"
+tar -xzf "${tmpdir}/${asset}" -C "${tmpdir}/plugin"
+if [[ ! -f "${tmpdir}/plugin/plugin.yaml" ]]; then
+  echo "${asset} has no plugin.yaml at its root; the release layout changed" >&2
+  exit 1
+fi
+
+if [[ -n "${installed}" ]]; then
+  echo "replacing helm-unittest ${installed} with ${VER}"
+  helm plugin uninstall unittest
+fi
+mkdir -p "${plugins_dir}"
+rm -rf "${plugins_dir}/unittest"
+mv "${tmpdir}/plugin" "${plugins_dir}/unittest"
+
+installed="$(helm plugin list 2>/dev/null | awk '$1 == "unittest" {print $2}')"
+if [[ "${installed}" != "${VER}" ]]; then
+  echo "helm plugin list reports unittest '${installed}' after install, expected ${VER}" >&2
+  exit 1
+fi
+echo "installed helm-unittest ${VER} (${os}/${arch}) into ${plugins_dir}/unittest"

hack/install-helm.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# Install a pinned Helm 3 release with SHA256-verified tarball download.
+# Install a pinned Helm release with SHA256-verified tarball download.
 # Checksums from https://get.helm.sh/helm-${VERSION}-${OS}-${ARCH}.tar.gz.sha256
-# Usage: HELM_VERSION=v3.22.1 hack/install-helm.sh [install-dir]
+# Usage: HELM_VERSION=v4.3.1 hack/install-helm.sh [install-dir]
 set -euo pipefail
 
-VERSION="${HELM_VERSION:-v3.22.1}"
+VERSION="${HELM_VERSION:-v4.3.1}"
 INSTALL_DIR="${1:-/usr/local/bin}"
 
 # CI-HELMDL-01 / CI-FETCHLIB-01. Both fetches below used to be bare `curl -fsSL`. On 2026-09-01