jf helm package fails to collect build-info when Chart.yaml and packaged chart archive are in different directories.

[kumadee]

• All tests passed. If this feature is not already covered by the tests, I added new tests.
• All static analysis checks passed.
• Appropriate label is added to auto generate release notes.
• I used gofmt for formatting the code before submitting the pull request.
• PR description is clear and concise, and it includes the proposed solution/fix.

---

Original issue was raised as a part of Jfrog support ticket 426969.

Here is the problem statement:
When jf helm package command is executed with multiple options contains different paths e.g. chart directory path, chart archive destination path, keyring path and all of these path are different, then the command fails as it expects a Chart.yaml in each of these directories.

In the below log the Chart.yaml is in ./target/my-app-chart and the my-app-384-SNAPSHOT.tgz is successfully created in ./target/helm. For some reason, the jf cli expects the Chart.yaml to be always in the same directory as the Chart.yaml.

$ /home/kumadee/git/dev/SCM/scms.Pipelinelibraries/jf helm package ./target/my-app-chart -d ./target/helm
08:53:39 [Debug] JFrog CLI version: 2.112.0
08:53:39 [Debug] OS/Arch: linux/amd64
08:53:39 [Debug] Trace ID for JFrog Platform logs: 6617edb913131a61
08:53:39 [Info] Running Helm  package .
Running alias script args: package ./target/my-app-chart -d target/helm/
08:53:39 [Debug] Sending HTTP GET request to: https://myartifactory.example.com/artifactory/api/system/version
08:53:39 [Debug] JFrog CLI version: 2.109.0
08:53:39 [Debug] OS/Arch: linux/amd64
08:53:39 [Debug] Trace ID for JFrog Platform logs: 893d29af54d911b0
08:53:39 [Info] Running Helm  package .
08:53:39 [Debug] Sending HTTP GET request to: https://myartifactory.example.com/artifactory/api/system/version
Successfully packaged chart and saved it to: target/helm/my-app-384-SNAPSHOT.tgz
08:53:39 [Debug] Artifactory response: 200 
08:53:39 [Debug] Artifactory Call Home: Sending info...
08:53:39 [Debug] Sending HTTP POST request to: https://myartifactory.example.com/artifactory/api/system/usage
08:53:39 [Debug] Sending HTTP POST request to: https://myartifactory.example.com/jfconnect/api/v1/backoffice/metrics/log
08:53:39 [Info] Collecting build info for executed helm package command
08:53:39 [Debug] Reading build general details from: /tmp/jfrog-kumadee/builds/2cdd5ec3b76db5669ce1c92bfe1d22492f77fc2409ab2c4c05655ef413006d81/partials
08:53:39 [Debug] Creating temp build file at: /tmp/jfrog-kumadee/builds/2cdd5ec3b76db5669ce1c92bfe1d22492f77fc2409ab2c4c05655ef413006d81
08:53:39 [Info] Build info saved locally. Use 'jf rt bp test-local-build 7-helm ' to publish it to Artifactory.
08:53:39 [Info] Trace ID for JFrog Platform logs: 893d29af54d911b0
08:53:39 [Error] failed to collect build info: failed to create Helm FlexPack: failed to load Chart.yaml: failed to read Chart.yaml: open /home/kumadee/git/dev/clear/my-app/k8s/target/helm/Chart.yaml: no such file or directory
08:53:39 [Debug] Artifactory response: 200 
08:53:39 [Debug] Artifactory Call Home: Sending info...
08:53:39 [Debug] Sending HTTP POST request to: https://myartifactory.example.com/artifactory/api/system/usage
08:53:39 [Debug] Sending HTTP POST request to: https://myartifactory.example.com/jfconnect/api/v1/backoffice/metrics/log
08:53:39 [Info] Trace ID for JFrog Platform logs: 6617edb913131a61
08:53:39 [Error] helm package failed: exit status 1

Proposed solution: Filter out the different paths given in the helm package CHART_DIR .... command. There can be only 1 chart directory in the command, which can be checked by the presence of Chart.yaml.

Summary by CodeRabbit

• Bug Fixes
  • Improved Helm packaging to identify the correct chart directory using Chart.yaml, while ignoring unrelated paths.
  • Prevented duplicate build-info collection and updates when packaging charts.
  • Added clearer error reporting when no valid chart directory is found or chart processing encounters an issue.
• Tests
  • Expanded coverage for multiple packaging input formats, chart detection, missing charts, and build-info dependency details.
  • Added validation for dependency identifiers and SHA256 values in generated build information.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[kumadee]

I have read the CLA Document and I hereby sign the CLA

[kumadee]

recheck

[naveenku-jfrog]

PR's branch is out of sync and all cli integration tests are failing, please fix these first.

[kumadee]

I have rebased the PR branch with the default branch. Unit tests are passing on my local. Waiting for the integration tests to be executed on CI.

[kumadee]

@naveenku-jfrog Could you please let me know what else do I need to do so that this PR can move forward? Do I need to ask JFrog support to give the reviewers any additional details?

[kumadee]

@naveenku-jfrog Could you please re-review the changes?

[naveenku-jfrog]

Static failure:
[/home/runner/work/jfrog-cli-artifactory/jfrog-cli-artifactory/artifactory/commands/helm/package_test.go:272] - G122 (CWE-367): Filesystem operation in filepath.Walk/WalkDir callback uses race-prone path; consider root-scoped APIs (e.g. os.Root) to prevent symlink TOCTOU traversal (Confidence: MEDIUM, Severity: HIGH)
271: }
> 272: content, err := os.ReadFile(path)
273: if err != nil {

[naveenku-jfrog]

static failure is present. and PR's branch is also out of sync.

[kumadee]

Static failure: [/home/runner/work/jfrog-cli-artifactory/jfrog-cli-artifactory/artifactory/commands/helm/package_test.go:272] - G122 (CWE-367): Filesystem operation in filepath.Walk/WalkDir callback uses race-prone path; consider root-scoped APIs (e.g. os.Root) to prevent symlink TOCTOU traversal (Confidence: MEDIUM, Severity: HIGH) 271: } > 272: content, err := os.ReadFile(path) 273: if err != nil {

@naveenku-jfrog Sorry, I was on vacation. I have fixed this now and successfully ran gosec on my local.
Could you please mention this step in the Contribution guide?

$ gosec -exclude G204,G301,G302,G304,G306,G602 -tests -exclude-dir \.*test\.* ./...
Summary:
  Gosec  : dev
  Files  : 789
  Lines  : 159575
  Nosec  : 144
  Issues : 0

[kumadee]

@naveenku-jfrog Could you please rerun the checks? It is pain to check and keep updating the branch with master.