build(deps): update Helm v4 to 4.0.1 and helm-secrets to 4.7.4 (#2304)

* build(deps): update Helm v4 from 4.0.0 to 4.0.1

Update Helm v4 binary and Go library dependency to version 4.0.1.

Changes:
- Update helm.sh/helm/v4 Go module from v4.0.0 to v4.0.1
- Update Helm binary version in all Dockerfiles (alpine, ubuntu, debian)
- Update SHA256 checksums for linux/amd64 and linux/arm64
- Update CI workflow matrix to test against v4.0.1
- Update HelmRecommendedVersion constant in pkg/app/init.go
- Update test mocks to return v4.0.1 version string
- Update test plugin fixture version

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>

* build(deps): update helm-secrets from 4.7.0 to 4.7.4

Update helm-secrets plugin version across all configurations:
- Docker images (all 3 variants) - use ARG variable for version
- CI test matrix
- Integration test defaults
- Unit test fixtures and expectations
- HelmSecretsRecommendedVersion constant
- Dynamic plugin installation in exec.go

Also update plugin filename format from helm-secrets-*.tgz to
secrets-{version}.tgz to match the new release naming convention.

Update suppress-output-line-regex test expected output for Helm 4.0.1
which now suppresses Service diff after ipFamily normalization.

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>

---------

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>

pkg/helmexec/exec.go

@@ -831,7 +831,13 @@ func (helm *execer) installHelmSecretsV4(version string) error {
 	helm.logger.Infof("Installing helm-secrets %s (split plugin architecture for Helm 4)", version)
 
 	baseURL := fmt.Sprintf("https://github.com/jkroepke/helm-secrets/releases/download/%s", version)
-	plugins := []string{"helm-secrets.tgz", "helm-secrets-getter.tgz", "helm-secrets-post-renderer.tgz"}
+	// Strip "v" prefix for filename (e.g., "v4.7.4" -> "4.7.4")
+	versionNum := strings.TrimPrefix(version, "v")
+	plugins := []string{
+		fmt.Sprintf("secrets-%s.tgz", versionNum),
+		fmt.Sprintf("secrets-getter-%s.tgz", versionNum),
+		fmt.Sprintf("secrets-post-renderer-%s.tgz", versionNum),
+	}
 
 	verifyFlag := ""
 	if !helm.options.EnforcePluginVerification {

pkg/helmexec/exec_test.go

@@ -31,7 +31,7 @@ func (mock *mockRunner) ExecuteStdIn(cmd string, args []string, env map[string]s
 
 func (mock *mockRunner) Execute(cmd string, args []string, env map[string]string, enableLiveOutput bool) ([]byte, error) {
 	if len(mock.output) == 0 && strings.Join(args, " ") == "version --short" {
-		return []byte("v4.0.0+g99cd196"), nil
+		return []byte("v4.0.1+g12500dd"), nil
 	}
 	return mock.output, mock.err
 }
@@ -147,8 +147,8 @@ exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.e
 `,
 		},
 		{
-			name:    "Helm 4.0.0 (force-update is default)",
-			version: "4.0.0",
+			name:    "Helm 4.0.1 (force-update is default)",
+			version: "4.0.1",
 			expected: `Adding repo myRepo https://repo.example.com/
 exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.example.com/ --cert-file cert.pem --key-file key.pem
 `,
@@ -558,8 +558,8 @@ v3.2.4+ge29ce2a
 }
 
 func Test_DecryptSecret(t *testing.T) {
-	// Set secrets plugin version to 4.0.0
-	if err := os.Setenv("HELM_PLUGINS", "../../test/plugins/secrets/4.0.0"); err != nil {
+	// Set secrets plugin version to 4.7.4
+	if err := os.Setenv("HELM_PLUGINS", "../../test/plugins/secrets/4.7.4"); err != nil {
 		t.Errorf("failed to set environment HELM_PLUGINS error: %s", err)
 	}
 	defer func() {
@@ -610,8 +610,8 @@ Decrypted %s/secretName into %s
 }
 
 func Test_DecryptSecretWithGotmpl(t *testing.T) {
-	// Set secrets plugin version to 4.0.0
-	if err := os.Setenv("HELM_PLUGINS", "../../test/plugins/secrets/4.0.0"); err != nil {
+	// Set secrets plugin version to 4.7.4
+	if err := os.Setenv("HELM_PLUGINS", "../../test/plugins/secrets/4.7.4"); err != nil {
 		t.Errorf("failed to set environment HELM_PLUGINS error: %s", err)
 	}
 	defer func() {
@@ -705,7 +705,7 @@ func Test_DiffRelease_ColorFlagHelm4(t *testing.T) {
 	var buffer bytes.Buffer
 	logger := NewLogger(&buffer, "debug")
 
-	// MockExecer creates a Helm 4 execer by default (returns v4.0.0)
+	// MockExecer creates a Helm 4 execer by default (returns v4.0.1)
 	helm, err := MockExecer(logger, "config", "dev")
 	if err != nil {
 		t.Errorf("unexpected error: %v", err)
@@ -1256,7 +1256,7 @@ func Test_IsHelm3(t *testing.T) {
 		t.Error("helmexec.IsHelm3() - Failed to detect Helm 3")
 	}
 
-	helm4Runner := mockRunner{output: []byte("v4.0.0+ge29ce2a\n")}
+	helm4Runner := mockRunner{output: []byte("v4.0.1+g12500dd\n")}
 	helm, err = New("helm", HelmExecOptions{}, NewLogger(os.Stdout, "info"), "", "dev", &helm4Runner)
 	if err != nil {
 		t.Errorf("unexpected error: %v", err)
@@ -1276,7 +1276,7 @@ func Test_IsHelm4(t *testing.T) {
 		t.Error("helmexec.IsHelm4() - Detected Helm 4 with Helm 3 version")
 	}
 
-	helm4Runner := mockRunner{output: []byte("v4.0.0+ge29ce2a\n")}
+	helm4Runner := mockRunner{output: []byte("v4.0.1+g12500dd\n")}
 	helm, err = New("helm", HelmExecOptions{}, NewLogger(os.Stdout, "info"), "", "dev", &helm4Runner)
 	if err != nil {
 		t.Errorf("unexpected error: %v", err)
@@ -1288,9 +1288,9 @@ func Test_IsHelm4(t *testing.T) {
 
 func Test_GetPluginVersion(t *testing.T) {
 	v3ExpectedVersion := "3.15.0"
-	v4ExpectedVersion := "4.0.0"
+	v4ExpectedVersion := "4.7.4"
 	v3PluginDirPath := "../../test/plugins/secrets/3.15.0"
-	v4PluginDirPath := "../../test/plugins/secrets/4.0.0"
+	v4PluginDirPath := "../../test/plugins/secrets/4.7.4"
 
 	v3SecretPluginVersion, err := GetPluginVersion("secrets", v3PluginDirPath)
 	require.NoError(t, err)