Fix | Stream branch root for local Helm charts with out-of-chart value files

[dag-andersen]

Problem

v0.2.9 (PR #443) regressed --render-method repo-server-api for local Helm charts whose helm.valueFiles reference files outside the chart directory. Rendering fails with:

failed to execute helm template command: ... --values /tmp/<uuid>/management-prod/hotel/clusters/.../config.yaml
Error: open /tmp/<uuid>/management-prod/hotel/clusters/.../config.yaml: no such file or directory

PR #443 added an optimization: for any local source directory containing Chart.yaml, the repo-server stream is narrowed to only the chart directory (and source.Path is cleared) to avoid sending unrelated monorepo files (symlink safety checks).

That optimization assumes the chart is self-contained. It is not when a chart pulls value files from a sibling directory tree. Argo CD resolves a leading-slash value file relative to the repository root (util/io/path/resolved.go -> ResolveValueFilePathOrUrl), and a relative value file relative to the chart directory. So a value file like:

source:
  path: charts/external-secrets        # chart dir (has Chart.yaml)
  helm:
    valueFiles:
      - /clusters/<cluster>/config.yaml # resolved relative to repo root

lives outside the narrowed stream root, so the file is no longer in the tarball -> no such file or directory. This is the Helm mirror image of the kustomize ../../base sibling-reference case the original comment already warned about.

Fix

buildStreamDirForLocalSource now only narrows to the chart directory when no helm.valueFiles escape the chart directory. The new hasOutOfChartValueFile helper mirrors Argo CD's resolution rules:

• leading-slash (absolute) value files resolve against the repo root,
• relative value files resolve against the chart directory,
• URL value files (e.g. https://...) are remote and ignored,

and a value file "escapes" when its resolved path is not within the chart directory. When any value file escapes, the whole branch folder is streamed (with Path retained) so the out-of-chart files remain reachable. The PR #443 optimization (and its symlink-scoping behaviour) is preserved for self-contained charts.

Tests

Added unit tests in pkg/reposerverextract/extract_test.go:

• local chart with an absolute out-of-chart value file -> streams branch root, and the value file is present in the streamed tarball (reproduces the reported failure)
• local chart with a relative ../ out-of-chart value file -> streams branch root
• local chart with in-chart value files -> still narrows to the chart dir (optimization preserved)

Both regression tests fail on main and pass with this change. Full unit suite is green and golangci-lint reports 0 issues. PR #443's symlink-scoping test still passes.

[dag-andersen]

Added an end-to-end integration test for this regression (commit 5201b29):

• New data branches integration-test/branch-18/{base,target} add a single-source local Helm chart (examples/out-of-chart-values/chart) whose helm.valueFiles reference a file outside the chart directory via a repo-root-absolute path: /examples/out-of-chart-values/env/values.yaml. Base and target differ only in that out-of-chart value file (replicas 2->3, image tag 1.25->1.27).
• New test case branch-18/target runs with --render-method repo-server-api and a watch-pattern scoped to the example folder, so only this app renders.

Verified locally:

• With this fix: renders cleanly and produces the expected diff (Test passed: branch-18/target).
• Without the fix (binary built from main): fails with the exact reported error - helm template . ... --values /tmp/<uuid>/examples/out-of-chart-values/env/values.yaml ... -> no such file or directory.

So the new integration test reproduces the regression and guards against it.