* feat: add per-release continue-on-error support
Work in progress for discussion #2799.
This introduces the initial release-level configuration needed to
continue processing independent releases after a deployment failure.
The DAG execution and failure propagation behavior are still being
implemented.
Refs #2799
Signed-off-by: Axel Delille <Axel.delille31@gmail.com>
* fix: address review findings for continueOnError
Review fixes for the per-release continueOnError feature:
1. Regenerate values-file ID hashes in pkg/state/temp_test.go — adding
ContinueOnError to ReleaseSpec shifts generateValuesID hashes, which
broke TestGenerateID (the test file notes these must be regenerated
whenever ReleaseSpec changes).
2. Remove the dead skippedErrors variable in withBatches and instead log
each skipped release with logger.Warnf at decision time, so users see
why a release never ran instead of only learning from the final error
list.
3. Aggregate all errors from a state file instead of returning only
errs[0] in visitStatesWithContext/processStateFileParallel. With
continueOnError, multiple releases can fail or be skipped in one run;
reporting only the first error hid the skip errors (and other
failures), contradicting the feature's contract. Single-error
rendering is unchanged.
4. Gate tolerated errors on ReleaseErrorCodeFailure so that non-failure
release errors (e.g. helm-diff's "changes detected" exit code 2 can
never enable continuation or block dependents.
5. Report skipped-release messages with the dependency's plain release
name instead of its kubeContext/namespace-qualified needs id
(e.g. dependency database instead of default/default/database),
matching the documented message format.
6. Restructure the withBatches helpers into guard-clause style
(filterBlockedReleases, toleratesBatchErrors) and drop the test-only
logger nil-guards in favor of a nop logger in tests.
7. Add end-to-end coverage through App.Sync with the exectest fake helm:
independent releases continue after a tolerated failure, dependents
are skipped with an explicit error, the exit code stays non-zero, and
fail-fast remains the default without continueOnError. Also cover the
non-failure error code case at the withBatches level.
8. Use new(true) instead of a boolPtr helper (CI-enforced check-modernize)
and document the failure-handling interaction in docs/releases.md.
Signed-off-by: yxxhero <aiopsclub@163.com>
EOF
)
Signed-off-by: yxxhero <aiopsclub@163.com>
---------
Signed-off-by: Axel Delille <Axel.delille31@gmail.com>
Signed-off-by: yxxhero <aiopsclub@163.com>
Co-authored-by: yxxhero <aiopsclub@163.com>
* feat: add `helmfile doctor` command for AI-assisted diff analysis
`helmfile doctor` runs `helmfile diff` and asks an OpenAI-compatible LLM to
summarize the changes and flag risks (data loss, security exposure, breaking
changes, downtime, performance, best-practice issues).
Key design decisions:
- When no LLM is configured, doctor is equivalent to `helmfile diff` with
one exception: --show-secrets is always forced off (secrets never reach
stdout, even without an LLM).
- Secrets are ALWAYS redacted via two layers: (1) ShowSecrets() forced to
false so helm-diff emits <REDACTED> placeholders; (2) a defense-in-depth
text redactor strips residual secret-looking content (Secret YAML blocks,
sensitive key/value lines, base64 blobs, JWT tokens) before LLM transmission.
- LLM configuration precedence: env (HELMFILE_LLM_*) < helmfile.yaml (llm:)
< CLI flags (--llm-*).
- Supports any OpenAI-compatible backend (OpenAI, Azure, One-API, LiteLLM,
Ollama, etc.) with automatic response_format fallback for backends that
don't support JSON mode.
- Prompt injection defense: release names and environment values are
JSON-encoded before insertion into the LLM prompt.
- Exit codes: 0 (success/low-risk), 2 (high-risk gate, bypass with --force),
1 (other errors). Helm-diff's 'detected changes' exit-2 is swallowed.
New packages:
- pkg/agent/llm: OpenAI-compatible client with JSON response parsing, mock
client for testing, prompt builder with injection defense.
- pkg/agent/doctor: secret redactor (state machine + regex), report renderer
(markdown + JSON), config resolver (env < yaml < flag merge).
Testing: 70+ unit tests covering redaction patterns, prompt injection,
response_format fallback, JSON parsing, yaml roundtrip, concurrency safety,
panic recovery, and error propagation. go test -race passes.
Documentation: full doctor section in docs/cli.md, llm: block reference in
docs/configuration.md, updated skills/helmfile for AI agents.
Signed-off-by: yxxhero <aiopsclub@163.com>
* docs: fix doctor equivalence wording per PR review
Per review feedback (PR #2660): the docs claimed doctor is 'equivalent to
helmfile diff — same flags, same output, same exit codes' in the unconfigured
path, but this over-promises because:
1. doctor --output is the report format (not helm-diff's output format)
2. helm-diff's --output is exposed as --diff-output in doctor
3. --show-secrets is silently ignored
Updated all three locations (cli.md, cmd/doctor.go Long + godoc, pkg/app/doctor.go
godoc) to say 'falls back to helmfile diff with --show-secrets forced off' and
explicitly note the --output / --diff-output flag difference.
Signed-off-by: yxxhero <aiopsclub@163.com>
---------
Signed-off-by: yxxhero <aiopsclub@163.com>
