feat(manager/flux): support chartRef in HelmRelease resources

lib/modules/manager/flux/__fixtures__/helmChart.yaml

@@ -0,0 +1,14 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmChart
+metadata:
+  name: sealed-secrets
+  namespace: kube-system
+spec:
+  interval: 10m
+  chart: sealed-secrets
+  sourceRef:
+    kind: HelmRepository
+    name: sealed-secrets
+  version: "2.0.2"
+  valuesFiles:
+    - values-prod.yaml

lib/modules/manager/flux/__fixtures__/helmChartRefRelease.yaml

@@ -0,0 +1,13 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: sealed-secrets
+  namespace: kube-system
+spec:
+  interval: 10m
+  chartRef:
+    kind: HelmChart
+    name: sealed-secrets
+    namespace: kube-system
+  values:
+    replicaCount: 2

lib/modules/manager/flux/common.ts

@@ -1,4 +1,8 @@
 import { regEx } from '../../../util/regex';
+import { HelmDatasource } from '../../datasource/helm';
+import type { PackageDependency } from '../types';
+import type { HelmChart, HelmRelease, HelmRepository } from './schema';
+import type { FluxManifest } from './types';
 
 export const systemManifestFileNameRegex = '(?:^|/)gotk-components\\.ya?ml$';
 
@@ -8,3 +12,87 @@ export const systemManifestHeaderRegex =
 export function isSystemManifest(file: string): boolean {
   return regEx(systemManifestFileNameRegex).test(file);
 }
+
+export function resolveHelmReleaseManifest(
+  resource: HelmRelease,
+  helmRepositories: HelmRepository[],
+  helmCharts: HelmChart[],
+): {
+  name: string;
+  dep: PackageDependency;
+  matchingRepositories: HelmRepository[];
+} | null {
+  if (resource.spec.chartRef) {
+    const chartRef = resource.spec.chartRef;
+    const helmChart = helmCharts.find(
+      (res) =>
+        res.kind === chartRef.kind &&
+        res.metadata.name === chartRef.name &&
+        res.metadata.namespace ===
+          (chartRef.namespace ?? resource.metadata?.namespace),
+    );
+    if (!helmChart) {
+      return null;
+    }
+    const chartName = helmChart.spec.chart;
+
+    const dep: PackageDependency = {
+      depName: chartName,
+      currentValue: helmChart.spec.version,
+      datasource: HelmDatasource.id,
+    };
+
+    const matchingRepositories = helmRepositories.filter(
+      (rep) =>
+        rep.kind === helmChart.spec.sourceRef?.kind &&
+        rep.metadata.name === helmChart.spec.sourceRef.name &&
+        rep.metadata.namespace === helmChart.metadata?.namespace,
+    );
+    return { name: chartName, dep, matchingRepositories };
+  } else if (resource.spec.chart) {
+    const chartSpec = resource.spec.chart.spec;
+    const chartName = chartSpec.chart;
+
+    const dep: PackageDependency = {
+      depName: chartName,
+      currentValue: resource.spec.chart.spec.version,
+      datasource: HelmDatasource.id,
+    };
+
+    const matchingRepositories = helmRepositories.filter(
+      (rep) =>
+        rep.kind === chartSpec.sourceRef?.kind &&
+        rep.metadata.name === chartSpec.sourceRef.name &&
+        rep.metadata.namespace ===
+          (chartSpec.sourceRef.namespace ?? resource.metadata?.namespace),
+    );
+
+    return { name: chartName, dep, matchingRepositories };
+  } else {
+    return null;
+  }
+}
+
+export function collectHelmReposAndCharts(
+  manifests: FluxManifest[],
+): [HelmRepository[], HelmChart[]] {
+  const helmRepositories: HelmRepository[] = [];
+  const helmCharts: HelmChart[] = [];
+
+  for (const manifest of manifests) {
+    if (manifest.kind === 'resource') {
+      for (const resource of manifest.resources) {
+        switch (resource.kind) {
+          case 'HelmRepository':
+            helmRepositories.push(resource);
+            break;
+          case 'HelmChart':
+            helmCharts.push(resource);
+            break;
+        }
+      }
+    }
+  }
+
+  return [helmRepositories, helmCharts];
+}

lib/modules/manager/flux/extract.spec.ts

@@ -150,6 +150,22 @@ describe('modules/manager/flux/extract', () => {
       });
     });
 
+    it('ignores HelmRelease resources without any chart reference', () => {
+      const result = extractPackageFile(
+        codeBlock`
+          apiVersion: helm.toolkit.fluxcd.io/v2beta1
+          kind: HelmRelease
+          metadata:
+            name: sealed-secrets
+            namespace: kube-system
+          spec:
+            interval: 10m
+        `,
+        'test.yaml',
+      );
+      expect(result).toBeNull();
+    });
+
     it('ignores HelmRelease resources without a chart name', () => {
       const result = extractPackageFile(
         codeBlock`
@@ -248,6 +264,35 @@ describe('modules/manager/flux/extract', () => {
       expect(result).toBeNull();
     });
 
+    it('does not match HelmRelease resources using chartRef without a namespace', () => {
+      const result = extractPackageFile(
+        codeBlock`
+          ${Fixtures.get('helmChart.yaml')}
+          ---
+          apiVersion: helm.toolkit.fluxcd.io/v2
+          kind: HelmRelease
+          metadata:
+            name: sealed-secrets
+            namespace: kube-system
+          spec:
+            chartRef:
+              kind: HelmChart
+              name: sealed-secrets
+        `,
+        'test.yaml',
+      );
+      expect(result).toEqual({
+        deps: [
+          {
+            currentValue: '2.0.2',
+            datasource: HelmDatasource.id,
+            depName: 'sealed-secrets',
+            skipReason: 'unknown-registry',
+          },
+        ],
+      });
+    });
+
     it('ignores HelmRepository resources without a namespace', () => {
       const result = extractPackageFile(
         codeBlock`
@@ -297,6 +342,68 @@ describe('modules/manager/flux/extract', () => {
       });
     });
 
+    it('ignores HelmRelease resources using a chartRef without a HelmChart', () => {
+      const result = extractPackageFile(
+        Fixtures.get('helmChartRefRelease.yaml'),
+        'test.yaml',
+      );
+      expect(result).toBeNull();
+    });
+
+    it('extracts HelmRelease resources using a chartRef without a valid HelmRepository', () => {
+      const result = extractPackageFile(
+        codeBlock`
+          ${Fixtures.get('helmChartRefRelease.yaml')}
+          ---
+          ${Fixtures.get('helmChart.yaml')}
+        `,
+        'test.yaml',
+      );
+      expect(result).toEqual({
+        deps: [
+          {
+            currentValue: '2.0.2',
+            datasource: HelmDatasource.id,
+            depName: 'sealed-secrets',
+            skipReason: 'unknown-registry',
+          },
+        ],
+      });
+    });
+
+    it('ignores HelmRelease resources using a chartRef targetting an OCIRepository', () => {
+      const result = extractPackageFile(
+        codeBlock`
+          ${Fixtures.get('ociSource.yaml')}
+          ---
+          apiVersion: helm.toolkit.fluxcd.io/v2
+          kind: HelmRelease
+          metadata:
+            name: kyverno-controller
+            namespace: kube-system
+          spec:
+            chartRef:
+              kind: OCIRepository
+              name: kyverno-controller
+              namespace: kube-system
+        `,
+        'test.yaml',
+      );
+      expect(result).toEqual({
+        deps: [
+          {
+            autoReplaceStringTemplate:
+              '{{#if newValue}}{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}',
+            currentDigest: undefined,
+            currentValue: 'v1.8.2',
+            depName: 'ghcr.io/kyverno/manifests/kyverno',
+            datasource: DockerDatasource.id,
+            replaceString: 'v1.8.2',
+          },
+        ],
+      });
+    });
+
     it('ignores GitRepository without a tag nor a commit', () => {
       const result = extractPackageFile(
         codeBlock`
@@ -847,5 +954,27 @@ describe('modules/manager/flux/extract', () => {
       ]);
       expect(result).toBeNull();
     });
+
+    it('should handle HelmRepository with chartRef', async () => {
+      const result = await extractAllPackageFiles(config, [
+        'lib/modules/manager/flux/__fixtures__/helmChartRefRelease.yaml',
+        'lib/modules/manager/flux/__fixtures__/helmChart.yaml',
+        'lib/modules/manager/flux/__fixtures__/helmSource.yaml',
+      ]);
+      expect(result).toEqual([
+        {
+          deps: [
+            {
+              currentValue: '2.0.2',
+              datasource: HelmDatasource.id,
+              depName: 'sealed-secrets',
+              registryUrls: ['https://bitnami-labs.github.io/sealed-secrets'],
+            },
+          ],
+          packageFile:
+            'lib/modules/manager/flux/__fixtures__/helmChartRefRelease.yaml',
+        },
+      ]);
+    });
   });
 });