Auto-detect helmCharts and enable helm + load-restrictor flags

[arlenskh]

Summary

• Inline-detect a non-empty helmCharts: block in the overlay's kustomization.yaml before every kustomize build and pass --enable-helm --load-restrictor=LoadRestrictionsNone automatically.
• Three build sites updated in the "Validate kustomization" step: the silent validation build, the error-path rebuild that surfaces the failure, and the manifest extraction used for the version-label selector check.
• Detection uses yq when available, with a grep fallback (yq is only conditionally auto-installed in this action when version_label is set, so the fallback matters here).
• Backward compatible: overlays without helmCharts: produce byte-identical output.

Why

Today, an overlay that adds helmCharts: fails the build with must specify --enable-helm, and once the flag is added the next failure is usually security; file '... base/values.yaml' is not in or below '... overlays/<env>' because the helm + shared-base-values pattern crosses kustomize's default LoadRestrictionsRootOnly. Argo CD's standard kustomize integration pairs both flags for the same reason. Doing this inline in the action means callers never need to coordinate workflow updates with the day they introduce a Helm chart, and forgetting an opt-in input can't silently break a deploy.

Test plan

• Unit-style: detection block tested against four overlay shapes (helmCharts with entries / [] / absent / comment-only) on yq path and grep fallback path — all match expected behavior.
• End-to-end via `catalog-api` deploy workflow against a real overlay declaring `helmCharts` + `helmGlobals.chartHome` + `valuesFile: ../../base/values.yaml` — kustomize build succeeds, Argo CD GitOps mode is detected, manifests committed.

🤖 Generated with Claude Code

---

Note

Medium Risk
Medium risk because it changes how kustomize build is invoked in the action (auto-enabling Helm and loosening load restrictions), which can alter validation/output for overlays using helmCharts and affects deploy-time safety checks.

Overview
This updates the action’s Validate kustomization step to auto-detect a non-empty helmCharts section in kustomization.yaml and, when present, run kustomize build with --enable-helm --load-restrictor=LoadRestrictionsNone.

The new flags are applied consistently across validation, error re-build output, and the manifest build used for the version-label selector check, with detection using yq when available and a grep fallback when it isn’t.

^{Reviewed by Cursor Bugbot for commit 6f9b1c4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6f9b1c4. Configure here.}

[cursor]

Grep fallback misses helmCharts with trailing YAML comments

Medium Severity

The grep fallback pattern '^helmCharts:[[:space:]]*$' requires end-of-line immediately after optional whitespace, so it won't match a helmCharts: line that has a trailing YAML comment (e.g. helmCharts: # deploy nginx). Since the yq path handles this correctly, the two detection paths are inconsistent. When yq is unavailable (i.e. version_label is not set), this false negative means --enable-helm is silently omitted, causing kustomize build to fail with no workaround in the action.

 

^{Reviewed by Cursor Bugbot for commit 6f9b1c4. Configure here.}

[github-actions]

🎉 This PR is included in version 1.6.0 🎉

The release is available on:

• GitHub release
• v1.6.0

Your semantic-release bot 📦🚀