fix: pre-build transitive subchart deps for envelope charts (#851)

Helm's `dependency build` on the parent chart fetches each file:// subchart
and packages it as .tgz, but does NOT recursively build the subchart's own
dependencies first. For envelope charts whose subcharts declare their own
local file:// dependencies, the resulting .tgz lacks the nested subchart's
resources. chartify's `helm template` then silently drops those resources,
and strategicMergePatches/jsonPatches targeting them fail with
"no resource matches".

Fix: add `preBuildTransitiveSubchartDeps`, called from processChartification
before chartify runs (gated on !skipDeps). It walks the transitive file://
dependency tree depth-first and runs `helm dependency build` bottom-up on each
subchart source directory, so each subchart's deps are pre-built before the
parent packages them. The function is best-effort: errors are logged at debug
level and do not abort the operation, matching helmfile's existing behavior
of tolerating already-built deps.

Verified with a reproduction case that fails before the fix
(`Error: no resource matches strategic merge patch ".../nested-sm.[noNs]"`)
and passes after it.

Resolves #851

Signed-off-by: yxxhero <aiopsclub@163.com>

test/integration/run.sh

@@ -132,6 +132,7 @@ ${kubectl} create namespace ${test_ns} || fail "Could not create namespace ${tes
 . ${dir}/test-cases/issue-2247.sh
 . ${dir}/test-cases/issue-2097.sh
 . ${dir}/test-cases/issue-2291.sh
+. ${dir}/test-cases/issue-851.sh
 . ${dir}/test-cases/oci-parallel-pull.sh
 . ${dir}/test-cases/issue-2297-local-chart-transformers.sh
 . ${dir}/test-cases/issue-2309-kube-context-template.sh

test/integration/test-cases/issue-851.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+
+# Test for issue #851: Strategic merge with envelope charts does not work
+# Issue: https://github.com/helmfile/helmfile/issues/851
+#
+# Problem: When an envelope chart's subchart declares its own local file://
+# dependency, helm's `dependency build` on the parent chart fetches the subchart
+# and packages it as .tgz, but does NOT recursively build the subchart's own
+# deps first. The resulting .tgz lacks the nested subchart's resources. chartify's
+# helm template silently drops those resources, and strategicMergePatches/jsonPatches
+# targeting them fail with "no resource matches".
+#
+# Fix: preBuildTransitiveSubchartDeps walks the transitive file:// dep tree and
+# runs `helm dependency build` bottom-up on each subchart source dir before
+# chartify runs, so every subchart .tgz includes its own nested deps.
+
+issue_851_input_dir="${cases_dir}/issue-851/input"
+
+# Copy the chart tree to a temp dir so the test doesn't leave generated
+# Chart.lock / charts/*.tgz files in the repo. preBuildTransitiveSubchartDeps
+# runs `helm dependency build` on subchart source directories, which creates
+# those artifacts. The test must not pollute the source tree.
+issue_851_tmp_dir=$(mktemp -d)
+cp -r "${issue_851_input_dir}/." "${issue_851_tmp_dir}/"
+
+cleanup_issue_851() {
+  rm -rf "${issue_851_tmp_dir}"
+}
+trap cleanup_issue_851 EXIT
+
+test_start "issue-851: strategic merge patches work with envelope charts"
+
+info "Step 1: Templating envelope chart whose subchart has its own file:// dep"
+${helmfile} -f "${issue_851_tmp_dir}/helmfile.yaml" template > "${issue_851_tmp_dir}/templated.yaml" 2>&1
+code=$?
+
+if [ $code -ne 0 ]; then
+  cat "${issue_851_tmp_dir}/templated.yaml"
+  fail "helmfile template failed — envelope chart with nested subchart patches should succeed"
+fi
+
+info "✓ helmfile template succeeded"
+
+# All three ServiceMonitors must be present, including the one defined in sub2's
+# OWN dependency (nested). Without the fix, nested-sm is silently dropped.
+for expected_name in sub1-sm sub2-sm nested-sm; do
+  if ! grep -q "name: ${expected_name}" "${issue_851_tmp_dir}/templated.yaml"; then
+    cat "${issue_851_tmp_dir}/templated.yaml"
+    fail "Expected ServiceMonitor ${expected_name} not found (envelope chart nested subchart resources dropped)"
+  fi
+  info "✓ ServiceMonitor ${expected_name} present"
+done
+
+# Each ServiceMonitor must reflect its strategicMergePatch.
+for expected_port in metrics-sub1 metrics-sub2 metrics-nested; do
+  if ! grep -q "port: ${expected_port}" "${issue_851_tmp_dir}/templated.yaml"; then
+    cat "${issue_851_tmp_dir}/templated.yaml"
+    fail "Patch targeting ${expected_port} was not applied (issue 851 regression)"
+  fi
+done
+info "✓ all strategicMergePatches applied (sub1-sm, sub2-sm, nested-sm)"
+
+# The critical assertion: nested-sm's patch applied. Without the fix, the nested
+# subchart's resources are missing and this patch fails with "no resource matches".
+if ! grep -q "port: metrics-nested" "${issue_851_tmp_dir}/templated.yaml"; then
+  cat "${issue_851_tmp_dir}/templated.yaml"
+  fail "Patch for nested-sm was not applied — envelope chart regression (issue 851)"
+fi
+info "✓ nested-sm patch applied (issue 851 fixed)"
+
+cleanup_issue_851
+trap - EXIT
+
+test_pass "issue-851: strategic merge patches work with envelope charts"

test/integration/test-cases/issue-851/input/envelope/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: envelope
+version: 0.1.0
+description: Envelope chart whose subchart has its own local file:// dep (issue 851)
+dependencies:
+  - name: sub1
+    version: 0.1.0
+    repository: file://../sub1
+  - name: sub2
+    version: 0.1.0
+    repository: file://../sub2

test/integration/test-cases/issue-851/input/envelope/templates/parent-cm.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: parent-cm
+data:
+  key: parent-value

test/integration/test-cases/issue-851/input/helmfile.yaml

@@ -0,0 +1,46 @@
+# Test for issue #851: Strategic merge with envelope charts does not work
+# https://github.com/helmfile/helmfile/issues/851
+#
+# Problem: When an envelope chart's subchart declares its own local file://
+# dependency, helm's `dependency build` on the parent chart fetches the subchart
+# and packages it as .tgz, but does NOT recursively build the subchart's own deps
+# first. The resulting .tgz lacks the nested subchart's resources. When chartify
+# runs helm template, resources from the nested subchart are silently absent,
+# and strategicMergePatches targeting them fail with "no resource matches".
+#
+# Fix: preBuildTransitiveSubchartDeps walks the transitive file:// dep tree and
+# runs `helm dependency build` bottom-up on each subchart source dir before
+# chartify runs, so every subchart .tgz includes its own nested deps.
+
+releases:
+  - name: envelope
+    namespace: test
+    chart: ./envelope
+    strategicMergePatches:
+      - apiVersion: monitoring.coreos.com/v1
+        kind: ServiceMonitor
+        metadata:
+          name: sub1-sm
+        spec:
+          endpoints:
+            - port: metrics-sub1
+              interval: 10s
+      - apiVersion: monitoring.coreos.com/v1
+        kind: ServiceMonitor
+        metadata:
+          name: sub2-sm
+        spec:
+          endpoints:
+            - port: metrics-sub2
+              interval: 15s
+      # The critical patch: targets a resource defined in sub2's OWN dependency
+      # (nested). Without the fix, this resource is dropped from chartify's
+      # patching set and the patch fails with "no resource matches".
+      - apiVersion: monitoring.coreos.com/v1
+        kind: ServiceMonitor
+        metadata:
+          name: nested-sm
+        spec:
+          endpoints:
+            - port: metrics-nested
+              interval: 20s

test/integration/test-cases/issue-851/input/nested/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v2
+name: nested
+version: 0.1.0
+description: Deepest nested subchart — its resources are silently dropped without the fix

test/integration/test-cases/issue-851/input/nested/templates/nested-sm.yaml

@@ -0,0 +1,8 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: nested-sm
+spec:
+  endpoints:
+    - port: web
+      interval: 30s

test/integration/test-cases/issue-851/input/sub1/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v2
+name: sub1
+version: 0.1.0
+description: Leaf subchart (no deps)

test/integration/test-cases/issue-851/input/sub1/templates/sub1-sm.yaml

@@ -0,0 +1,8 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: sub1-sm
+spec:
+  endpoints:
+    - port: web
+      interval: 30s

test/integration/test-cases/issue-851/input/sub2/Chart.yaml

@@ -0,0 +1,8 @@
+apiVersion: v2
+name: sub2
+version: 0.1.0
+description: Subchart with its own local file:// dep (the envelope chart scenario)
+dependencies:
+  - name: nested
+    version: 0.1.0
+    repository: file://../nested

test/integration/test-cases/issue-851/input/sub2/templates/sub2-sm.yaml

@@ -0,0 +1,8 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: sub2-sm
+spec:
+  endpoints:
+    - port: web
+      interval: 30s