build(deps): update Helm v4 to 4.0.1 and helm-secrets to 4.7.4 (#2304)

* build(deps): update Helm v4 from 4.0.0 to 4.0.1

Update Helm v4 binary and Go library dependency to version 4.0.1.

Changes:
- Update helm.sh/helm/v4 Go module from v4.0.0 to v4.0.1
- Update Helm binary version in all Dockerfiles (alpine, ubuntu, debian)
- Update SHA256 checksums for linux/amd64 and linux/arm64
- Update CI workflow matrix to test against v4.0.1
- Update HelmRecommendedVersion constant in pkg/app/init.go
- Update test mocks to return v4.0.1 version string
- Update test plugin fixture version

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>

* build(deps): update helm-secrets from 4.7.0 to 4.7.4

Update helm-secrets plugin version across all configurations:
- Docker images (all 3 variants) - use ARG variable for version
- CI test matrix
- Integration test defaults
- Unit test fixtures and expectations
- HelmSecretsRecommendedVersion constant
- Dynamic plugin installation in exec.go

Also update plugin filename format from helm-secrets-*.tgz to
secrets-{version}.tgz to match the new release naming convention.

Update suppress-output-line-regex test expected output for Helm 4.0.1
which now suppresses Service diff after ipFamily normalization.

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>

---------

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>

test/integration/run.sh

@@ -29,7 +29,7 @@ export HELM_PLUGINS="${HELM_DATA_HOME}/plugins"
 export HELM_CONFIG_HOME="${helm_dir}/config"
 HELM_DIFF_VERSION="${HELM_DIFF_VERSION:-3.14.1}"
 HELM_GIT_VERSION="${HELM_GIT_VERSION:-1.4.1}"
-HELM_SECRETS_VERSION="${HELM_SECRETS_VERSION:-4.7.0}"
+HELM_SECRETS_VERSION="${HELM_SECRETS_VERSION:-4.7.4}"
 export GNUPGHOME="${PWD}/${dir}/.gnupg"
 export SOPS_PGP_FP="B2D6D7BBEC03B2E66571C8C00AD18E16CFDEF700"
 

test/integration/test-cases/hcl-secrets.sh

@@ -14,9 +14,9 @@ info "Ensure helm-secrets is installed"
 # Helm 3 always uses single plugin installation regardless of helm-secrets version
 if [[ "${HELMFILE_HELM4}" == "1" ]] && [[ "$(printf '%s\n' "4.7.0" "${HELM_SECRETS_VERSION}" | sort -V | head -n1)" == "4.7.0" ]]; then
     info "Installing helm-secrets v${HELM_SECRETS_VERSION} (split plugin architecture for Helm 4)"
-    ${helm} plugin install https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/helm-secrets.tgz ${PLUGIN_INSTALL_FLAGS} || true
-    ${helm} plugin install https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/helm-secrets-getter.tgz ${PLUGIN_INSTALL_FLAGS} || true
-    ${helm} plugin install https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/helm-secrets-post-renderer.tgz ${PLUGIN_INSTALL_FLAGS} || true
+    ${helm} plugin install https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/secrets-${HELM_SECRETS_VERSION}.tgz ${PLUGIN_INSTALL_FLAGS} || true
+    ${helm} plugin install https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/secrets-getter-${HELM_SECRETS_VERSION}.tgz ${PLUGIN_INSTALL_FLAGS} || true
+    ${helm} plugin install https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/secrets-post-renderer-${HELM_SECRETS_VERSION}.tgz ${PLUGIN_INSTALL_FLAGS} || true
 else
     info "Installing helm-secrets v${HELM_SECRETS_VERSION} (single plugin)"
     ${helm} plugin install https://github.com/jkroepke/helm-secrets --version v${HELM_SECRETS_VERSION} ${PLUGIN_INSTALL_FLAGS} || true

test/integration/test-cases/secretssops.sh

@@ -32,9 +32,9 @@ info "Ensure helm-secrets is installed"
 # Helm 3 always uses single plugin installation regardless of helm-secrets version
 if [[ "${HELMFILE_HELM4}" == "1" ]] && [[ "$(printf '%s\n' "4.7.0" "${HELM_SECRETS_VERSION}" | sort -V | head -n1)" == "4.7.0" ]]; then
     info "Installing helm-secrets v${HELM_SECRETS_VERSION} (split plugin architecture for Helm 4)"
-    ${helm} plugin install https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/helm-secrets.tgz ${PLUGIN_INSTALL_FLAGS}
-    ${helm} plugin install https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/helm-secrets-getter.tgz ${PLUGIN_INSTALL_FLAGS}
-    ${helm} plugin install https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/helm-secrets-post-renderer.tgz ${PLUGIN_INSTALL_FLAGS}
+    ${helm} plugin install https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/secrets-${HELM_SECRETS_VERSION}.tgz ${PLUGIN_INSTALL_FLAGS}
+    ${helm} plugin install https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/secrets-getter-${HELM_SECRETS_VERSION}.tgz ${PLUGIN_INSTALL_FLAGS}
+    ${helm} plugin install https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/secrets-post-renderer-${HELM_SECRETS_VERSION}.tgz ${PLUGIN_INSTALL_FLAGS}
 else
     info "Installing helm-secrets v${HELM_SECRETS_VERSION} (single plugin)"
     ${helm} plugin install https://github.com/jkroepke/helm-secrets --version v${HELM_SECRETS_VERSION} ${PLUGIN_INSTALL_FLAGS}

test/integration/test-cases/suppress-output-line-regex/input/helmfile.yaml.gotmpl

@@ -2,9 +2,6 @@ helmDefaults:
   suppressOutputLineRegex:
     - "helm.sh/chart"
     - "app.kubernetes.io/version"
-  # Disable auto-detected kubeVersion to prevent helm-diff from normalizing server-side defaults
-  # which would hide changes like ipFamilyPolicy and ipFamilies being removed
-  disableAutoDetectedKubeVersionForDiff: true
 
 repositories:
 - name: ingress-nginx 

test/integration/test-cases/suppress-output-line-regex/output/diff-after-helm-diff-3.11.0-helm4

@@ -496,40 +496,7 @@ helmfile-tests, ingress-nginx-controller, Deployment (apps) has changed:
           - name: webhook-cert
             secret:
               secretName: ingress-nginx-admission
-helmfile-tests, ingress-nginx-controller, Service (v1) has changed:
-  # Source: ingress-nginx/templates/controller-service.yaml
-  apiVersion: v1
-  kind: Service
-  metadata:
-    annotations:
-    labels:
-      app.kubernetes.io/name: ingress-nginx
-      app.kubernetes.io/instance: ingress-nginx
-      app.kubernetes.io/part-of: ingress-nginx
-      app.kubernetes.io/managed-by: Helm
-      app.kubernetes.io/component: controller
-    name: ingress-nginx-controller
-    namespace: helmfile-tests
-  spec:
-    type: LoadBalancer
--   ipFamilyPolicy: SingleStack
--   ipFamilies: 
--     - IPv4
-    ports:
-      - name: http
-        port: 80
-        protocol: TCP
-        targetPort: http
-        appProtocol: http
-      - name: https
-        port: 443
-        protocol: TCP
-        targetPort: https
-        appProtocol: https
-    selector:
-      app.kubernetes.io/name: ingress-nginx
-      app.kubernetes.io/instance: ingress-nginx
-      app.kubernetes.io/component: controller
+helmfile-tests, ingress-nginx-controller, Service (v1) has changed, but diff is empty after suppression.
 helmfile-tests, ingress-nginx-controller-admission, Service (v1) has changed, but diff is empty after suppression.
 helmfile-tests, nginx, IngressClass (networking.k8s.io) has changed, but diff is empty after suppression.
 helmfile-tests, ingress-nginx-admission, NetworkPolicy (networking.k8s.io) has been removed:

test/integration/test-cases/suppress-output-line-regex/output/diff-live-after-helm-diff-3.11.0-helm4

@@ -496,40 +496,7 @@ helmfile-tests, ingress-nginx-controller, Deployment (apps) has changed:
           - name: webhook-cert
             secret:
               secretName: ingress-nginx-admission
-helmfile-tests, ingress-nginx-controller, Service (v1) has changed:
-  # Source: ingress-nginx/templates/controller-service.yaml
-  apiVersion: v1
-  kind: Service
-  metadata:
-    annotations:
-    labels:
-      app.kubernetes.io/name: ingress-nginx
-      app.kubernetes.io/instance: ingress-nginx
-      app.kubernetes.io/part-of: ingress-nginx
-      app.kubernetes.io/managed-by: Helm
-      app.kubernetes.io/component: controller
-    name: ingress-nginx-controller
-    namespace: helmfile-tests
-  spec:
-    type: LoadBalancer
--   ipFamilyPolicy: SingleStack
--   ipFamilies: 
--     - IPv4
-    ports:
-      - name: http
-        port: 80
-        protocol: TCP
-        targetPort: http
-        appProtocol: http
-      - name: https
-        port: 443
-        protocol: TCP
-        targetPort: https
-        appProtocol: https
-    selector:
-      app.kubernetes.io/name: ingress-nginx
-      app.kubernetes.io/instance: ingress-nginx
-      app.kubernetes.io/component: controller
+helmfile-tests, ingress-nginx-controller, Service (v1) has changed, but diff is empty after suppression.
 helmfile-tests, ingress-nginx-controller-admission, Service (v1) has changed, but diff is empty after suppression.
 helmfile-tests, nginx, IngressClass (networking.k8s.io) has changed, but diff is empty after suppression.
 helmfile-tests, ingress-nginx-admission, NetworkPolicy (networking.k8s.io) has been removed: