feat: new major 2.0 release - #576
Open
ilya-lesikov wants to merge 89 commits into
Open
Conversation
git-subtree-dir: pkg/helm git-subtree-split: f03cc04caaa8f6d7c3e67cf918929150cf6f3f12
ilya-lesikov
force-pushed
the
2
branch
2 times, most recently
from
March 27, 2026 21:12
a1c5169 to
09883a0
Compare
Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
ilya-lesikov
commented
Apr 6, 2026
dmmordvi
force-pushed
the
2
branch
3 times, most recently
from
April 7, 2026 08:28
6b65692 to
b2bc126
Compare
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
…werf.io` Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
…1.10.2 (#591) Move cobra fork from andremueller/cobra to werf/3p-cobra with EnableErrorOnUnknownSubcommand patches cherry-picked onto cobra v1.10.2. Also bumps pflag v1.0.5 -> v1.0.9. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
ilya-lesikov
commented
Apr 7, 2026
…e table date format Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> # Conflicts: # cmd/nelm/chart_pack.go # go.mod # go.sum # pkg/action/chart_render.go # pkg/chart/chart_render.go # pkg/common/common.go # pkg/helm/pkg/action/package.go # pkg/helm/pkg/chart/loader/load.go # pkg/helm/pkg/chart/v2/chart.go # pkg/helm/pkg/cmd/package.go # pkg/helm/pkg/werf/helmopts/helmoptions.go # pkg/ts/bundle.go # pkg/ts/bundle_ai_test.go # pkg/ts/files.go # pkg/ts/render.go # pkg/ts/render_ai_test.go # pkg/ts/render_test.go
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
- key deno:embed fingerprint per platform via label, otherwise a warm workspace regenerates only one platform after a denoVersion bump and ships stale deno blobs for the rest - join user tags with embeddeno by comma: space-joined -tags rejects commas in go build - validate embedded deno checksum as normalized hex in the public ExtractEmbeddedDeno (it is used as a cache path component), drop the now-redundant TrimSpace at the call site - gitignore deno.sha256.tmp left behind by a killed generator - skip the download-cache fallthrough subtest under -tags embeddeno where the embedded blob legitimately wins Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Both integrity checks of the deno binary were circular. The download path fetched the expected sha256 from the same host, over the same connection, moments before the archive it was supposed to vouch for, so it could only catch a broken transfer. The embedded path was worse: embed-deno hashed whatever it had just downloaded, wrote that digest next to the blob, and the runtime verified the blob against it, proving only that gzip round tripped. Move the trust anchor into the repository. pkg/ts/denolock records the pinned version and, per platform, the sha256 of the release archive and of the binary inside it; it is committed and embedded, so what a binary verifies against went through code review and is in git history. The download path checks the archive and the unpacked binary against it, and embed-deno no longer records a digest of its own. The lock is generated by scripts/denolock, which cross-checks each digest against the .sha256sum upstream publishes - the one thing that file can still tell us - and offers -verify (offline, wired into lint) and -check-upstream, which reports a release asset replaced under an existing tag. The lock is now the only place the deno version is configured. wormatter is no longer applied to pkg/ts/embed_*.go: it drops the //go:embed directive of a single var declaration, which compiles fine and silently produces a binary with an empty embedded deno. Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
cmd/ now holds only what ships. embed-deno is build tooling like schemagen and denolock, and it is invoked as "go run <module>/scripts/embed-deno", which werf has to follow. TypeScriptOptions.EmbeddedDenoSHA256 is gone. An embedder can only hand over the release pkg/ts/denolock pins - it downloads it through nelm's own embed-deno - so nelm looks the digest up itself instead of trusting one passed alongside the bytes. That closes the last path where a digest came from outside the repository, and drops a field embedders had to fill correctly for the check to mean anything. ExtractEmbeddedDeno is unexported for the same reason: with the digest no longer supplied by the caller, nothing outside pkg/ts has a use for it. Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
…ompat Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
Integrate origin/main (1.28.0 line) into the 2.0 branch, resolving 11 conflicts per the established taxonomy: take 2's side for AGENTS.md, lookup_ai_test.go and util/manifest.go; keep the legacy uninstall action deleted; hand-port main's asymmetric commits onto 2's refactored structure. Ports: 6707d35 release-get optimization onto 2's Accessor-based ReleaseStorager (new GetRelease, metadata client on the secret/configmap drivers); 4c9dd90 deploy-dependency readiness retargeted from multitrack/InternalDependency to statestore/Dependency, with release namespace normalisation threaded into dependencyMatcher on the deploy paths only; da9a86a LegacyNoReleaseLock in release_install plus a new test; 6092c11 AdoptDeckhouseControllerFields kept as a feature gate. Also fixes three duplicate-definition mis-merges (engine.go SetClientProvider, chart_render.go --lookup-resources flag) and regenerates docs/reference.md. Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
`forceReadinessTrackingForReadyDependencyTargets` iterated every ready dependency and matched it against local resource infos. External dependencies are tracked by their own operation keyed on the dependency itself (`resolveTrackReadinessOpInStage` never consults local infos for them), so forcing a same-named local resource served no edge while silently overriding that resource's chart-authored fail mode with `FailWholeDeployProcessImmediately`. Upstream had no `External` notion when this function was written, so the port inherited the gap. Also extract the triplicated release-lock construction guard into `newReleaseLockManager` so install/rollback/uninstall share one seam that tests can exercise, and rename `CompareInternalDependencyOption` to match the `Dependency` type it actually sorts. Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Custom resources whose readiness lives in status.conditions were never tracked by the heuristic, because kubedog built its universal condition rules from lowercase type names while real resources use CamelCase. Fixing that makes previously instantly-ready resources start blocking, so it is opt-in: NELM_FEAT_CASE_INSENSITIVE_CONDITION_TRACKING=true forwards the option to the readiness tracker, and the gate defaults to off. The CloudNativePG Cluster fix that prompted this is deliberately not behind the gate — it is an exact rule in kubedog and applies unconditionally. Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Protect shared action configuration updates because concurrent Helm command initialization races on its client and storage fields. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Remove the case-insensitive-condition-tracking feature gate so that matching custom resource status condition types case-insensitively is unconditional and cannot be disabled. The gate declaration, its gate-only tests and the readiness tracker option it fed are gone; the CLI help, generated reference docs and the unsupported environment variable warning all derive from the gate registry, so they follow automatically and NELM_FEAT_CASE_INSENSITIVE_CONDITION_TRACKING is now reported as unsupported. A custom resource carrying a CamelCase Ready/Available condition previously matched no rule and was reported ready immediately; it now blocks until that condition is True, so deployments that appeared to succeed may start timing out. Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.