helmreg

Documentation

Overview

Package helmreg asks the chart repository a Helm dependency resolves from what its own index.yaml says about it. Helm charts have no OSV.dev ecosystem and no deps.dev coverage, so — like Packagist, hex.pm, pub.dev, CRAN and the Bazel Central Registry before it — this package IS the metadata layer for Helm, not a fallback:

• Release ages and the ⏱ cooldown flag, from each version's `created` timestamp in the repository index — the exact document `helm dependency update` resolves against.
• Deprecated charts land in the deprecation lane: Helm's own convention is `deprecated: true` on the chart's releases. A bump onto a deprecated release flags directly; a chart whose LATEST release is deprecated flags any bump, worded apart.
• Registry-verified unlisted detection, with a pruning guard: chart repositories routinely PRUNE old releases from their index (the bitnami index famously keeps only recent months), so absence alone proves nothing. lockvet only flags an incoming version that is missing while it sorts AT OR ABOVE the oldest release the index still lists — a hole among the versions the repository actively serves, which is what a pulled or never-published release looks like. Absence is re-proven with an uncached fetch before it is claimed; charts the index does not know at all are never flagged.
• Source links: each release's `sources` (or `home`) names the upstream repository, feeding verified compare links and -changelogs exactly like the other registry layers.

The repository URL comes from the lockfile itself (Chart.lock / Chart.yaml entries record it), so any HTTP(S) chart repository works — there is no central Helm registry to hardcode. oci:// references have no index.yaml and are honestly skipped; file:// subcharts are NonRegistry. Whether the browser (wasm) playground can query a given repository depends on that repository's CORS headers (GitHub Pages-hosted repos answer; others may not) — failures make no claims.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)
• func Latest(repo, chart string) (string, error)

Variables

var Enabled = true

Enabled gates the whole layer.

var Now = time.Now

Now is a var so tests can pin the clock.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Annotate fills Helm chart metadata on the diffs; see the package comment for what it covers. The returned bool reports whether at least one chart was actually vetted against its repository index. freshDays mirrors -fresh-days. Best-effort: per-repository failures make no claims; only total failure returns an error.

func Latest

func Latest(repo, chart string) (string, error)

Latest resolves the newest listed release of a chart against its repository's index: the highest stable, non-deprecated version (prereleases and deprecated releases only win when nothing else is listed). Used by `lockvet pkg helm:<repo>/<chart>`.