Upgrade CI to Helm 4

.github/workflows/helm-charts-test.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
-          version: v3.22.0 # helm
+          version: v4.3.0
 
       - name: Set up chart-testing
         uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0

.github/workflows/helm-publish.yml

@@ -89,7 +89,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
-          version: 'v3.22.0'
+          version: 'v4.3.0'
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

.github/workflows/operator-ci.yml

@@ -182,6 +182,8 @@ jobs:
 
     - name: Set up Helm
       uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+      with:
+        version: v4.3.0
 
     - name: Setup Ko
       uses: ko-build/setup-ko@61b4d1d396f5b2e7d6bb6fefdce3dc38d1a13445 # v0.10

.github/workflows/test-e2e-lifecycle.yml

@@ -63,6 +63,8 @@ jobs:
 
     - name: Set up Helm
       uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+      with:
+        version: v4.3.0
 
     - name: Setup Ko
       uses: ko-build/setup-ko@61b4d1d396f5b2e7d6bb6fefdce3dc38d1a13445 # v0.10

Taskfile.yml

@@ -85,13 +85,19 @@ tasks:
   helm-unittest:
     desc: Run helm-unittest suites against the Helm charts
     vars:
-      # Pinned version — bump deliberately alongside the matching pin in
-      # .github/workflows/helm-charts-test.yml.
-      HELM_UNITTEST_VERSION: v1.0.3
-    cmds:
+      # Pinned version — bump deliberately. CI has no separate pin; the
+      # helm-charts-test workflow just runs this task.
+      HELM_UNITTEST_VERSION: v1.1.2
+    cmds:
+      # Helm 4 verifies plugin signatures by default and a git checkout carries
+      # no provenance, so the install fails without --verify=false. Helm 3 has
+      # no --verify flag at all and rejects it as unknown, so probe for the flag
+      # instead of making Helm 4 a hard requirement for chart contributors.
       - >-
         helm plugin list | grep -q unittest ||
-        helm plugin install https://github.com/helm-unittest/helm-unittest --version {{.HELM_UNITTEST_VERSION}}
+        helm plugin install https://github.com/helm-unittest/helm-unittest
+        --version {{.HELM_UNITTEST_VERSION}}
+        $(helm plugin install --help | grep -qE '^\s+--verify\b' && echo --verify=false)
       - helm unittest deploy/charts/operator-crds
       - helm unittest deploy/charts/operator
 

deploy/charts/operator-crds/README.md

@@ -18,7 +18,7 @@ helm upgrade -i toolhive-operator-crds oci://ghcr.io/stacklok/toolhive/toolhive-
 ## Prerequisites
 
 - Kubernetes 1.25+
-- Helm 3.10+ minimum, 3.14+ recommended
+- Helm 3.10+ (3.14+ recommended) or Helm 4
 
 ## Usage
 

deploy/charts/operator-crds/README.md.gotmpl

@@ -26,7 +26,7 @@ helm upgrade -i toolhive-operator-crds oci://ghcr.io/stacklok/toolhive/toolhive-
 ## Prerequisites
 
 - Kubernetes 1.25+
-- Helm 3.10+ minimum, 3.14+ recommended
+- Helm 3.10+ (3.14+ recommended) or Helm 4
 
 ## Usage
 

deploy/charts/operator/README.md

@@ -16,7 +16,7 @@ helm upgrade -i toolhive-operator oci://ghcr.io/stacklok/toolhive/toolhive-opera
 ## Prerequisites
 
 - Kubernetes 1.25+
-- Helm 3.10+ minimum, 3.14+ recommended
+- Helm 3.10+ (3.14+ recommended) or Helm 4
 
 ## Usage
 

deploy/charts/operator/README.md.gotmpl

@@ -24,7 +24,7 @@ helm upgrade -i toolhive-operator oci://ghcr.io/stacklok/toolhive/toolhive-opera
 ## Prerequisites
 
 - Kubernetes 1.25+
-- Helm 3.10+ minimum, 3.14+ recommended
+- Helm 3.10+ (3.14+ recommended) or Helm 4
 
 ## Usage
 

renovate.json

@@ -189,13 +189,6 @@
         "github.com/mark3labs/mcp-go",
         "github.com/modelcontextprotocol/registry"
       ]
-    },
-    {
-      "description": "Only allow minor and patch updates for Helm CLI (avoid v4.x)",
-      "matchManagers": ["custom.regex"],
-      "matchPackageNames": ["helm/helm"],
-      "matchUpdateTypes": ["major"],
-      "enabled": false
     }
   ],
   "customManagers": [
@@ -251,15 +244,6 @@
       "matchStrings": ["release:\\s+v(?<currentValue>\\d+\\.\\d+\\.\\d+)\\s+#\\s+chainsaw"],
       "depNameTemplate": "kyverno/chainsaw",
       "datasourceTemplate": "github-releases"
-    },
-    {
-      "customType": "regex",
-      "description": "Update Helm CLI version in GitHub workflows",
-      "managerFilePatterns": [".github/workflows/*.yml"],
-      "matchStrings": ["version:\\s+v(?<currentValue>\\d+\\.\\d+\\.\\d+)\\s+#\\s+helm"],
-      "depNameTemplate": "helm/helm",
-      "datasourceTemplate": "github-releases",
-      "extractVersionTemplate": "^v(?<version>.*)$"
     }
   ],
   "postUpdateOptions": ["gomodTidy"]