Fix | Reject Helm hooks with CLI renderer

cmd/options.go

@@ -507,6 +507,12 @@ func (o *RawOptions) ToConfig() (*Config, error) {
 		return nil, fmt.Errorf("--traverse-app-of-apps requires --render-method=repo-server-api (current: %s)", cfg.RenderMethod)
 	}
 
+	// Helm hooks are not returned by the Argo CD CLI renderer. They can only be
+	// included when manifests are fetched through one of the API renderers.
+	if cfg.IncludeHelmHooks && cfg.RenderMethod == RenderMethodCLI {
+		return nil, fmt.Errorf("--include-helm-hooks is incompatible with --render-method=cli; use --render-method=server-api or --render-method=repo-server-api")
+	}
+
 	// Check if argocd CLI is installed when not using API mode
 	if cfg.RenderMethod == RenderMethodCLI && !cfg.DryRun {
 		if _, err := exec.LookPath("argocd"); err != nil {

cmd/options_test.go

@@ -32,3 +32,32 @@ func TestNewLogger_Human(t *testing.T) {
 
 	assert.Equal(t, "failed to render (app: my-app)", strings.TrimSpace(buf.String()))
 }
+
+func TestRawOptionsToConfig_IncludeHelmHooksRenderMethod(t *testing.T) {
+	baseOptions := func(renderMethod string) RawOptions {
+		return RawOptions{
+			BaseBranch:       "main",
+			TargetBranch:     "feature",
+			Repo:             "example/repo",
+			RenderMethod:     renderMethod,
+			IncludeHelmHooks: true,
+			DryRun:           true,
+		}
+	}
+
+	t.Run("rejects CLI renderer", func(t *testing.T) {
+		options := baseOptions("cli")
+		_, err := options.ToConfig()
+		require.EqualError(t, err, "--include-helm-hooks is incompatible with --render-method=cli; use --render-method=server-api or --render-method=repo-server-api")
+	})
+
+	for _, renderMethod := range []string{"server-api", "repo-server-api"} {
+		t.Run(renderMethod, func(t *testing.T) {
+			options := baseOptions(renderMethod)
+			cfg, err := options.ToConfig()
+			require.NoError(t, err)
+			assert.True(t, cfg.IncludeHelmHooks)
+			assert.Equal(t, RenderMethod(renderMethod), cfg.RenderMethod)
+		})
+	}
+}

integration-test/README.md

@@ -183,12 +183,12 @@ Each `branch-N/target[-suffix]/` directory contains expected output files (`outp
 ### Branch 15: Additional Coverage
 - `target`: Basic diff (no special options)
 
-### Branch 16-20: repo-server-api Render Method
+### Branch 16-21: repo-server-api Render Method
 - `branch-16/target`: Config Management Plugin (kustomize-build-with-helm) via `repo-server-api`
 - `branch-17/target-1` / `target-2`: App-of-apps traversal via `repo-server-api`
 - `branch-18/target`: Single-source local Helm chart whose `helm.valueFiles` reference a file OUTSIDE the chart directory via a repo-root-absolute path (`/examples/out-of-chart-values/env/values.yaml`). Regression test for `repo-server-api`: the tool must stream the whole branch folder so the out-of-chart value file is reachable, otherwise the render fails with `no such file or directory`.
 - `branch-19/target`: Kustomize resource outside the application directory via `repo-server-api`. It requires global `kustomize.buildOptions: --load-restrictor LoadRestrictionsNone` from `argocd-cm`, proving the direct repo-server request forwards that setting.
-- `branch-20/target`: Local Helm chart that gates a ServiceMonitor on the kind-level capability `monitoring.coreos.com/v1/ServiceMonitor`, via `repo-server-api` against a cluster with the ServiceMonitor CRD. The target enables it, so the diff must show the ServiceMonitor added, as a real Argo CD sync would render it.
+- `branch-21/target`: Local Helm chart that gates a ServiceMonitor on the kind-level capability `monitoring.coreos.com/v1/ServiceMonitor`, via `repo-server-api` against a cluster with the ServiceMonitor CRD. The target enables it, so the diff must show the ServiceMonitor added, as a real Argo CD sync would render it.
 
 ## Prerequisites
 

integration-test/branch-2/target-1/output.html

@@ -60,7 +60,7 @@ <h1>Argo CD Diff Preview</h1>
 
 <p>Summary:</p>
 <pre>Modified (1):
-± internal-chart-example (+7|-7)</pre>
+± internal-chart-example (+5|-5)</pre>
 
 <div class="diffs">
 <details>
@@ -113,36 +113,6 @@ <h4 class="resource_header">Deployment: default/super-app-name → default/new-a
 </table>
 </div>
 
-<h4 class="resource_header">Pod: default/super-app-name-test-connection → default/new-app-name-test-connection</h4>
-<div class="diff_container">
-<table>
-
-	<tr class="normal_line"><td><pre> kind: Pod</pre></td></tr>
-	<tr class="normal_line"><td><pre> metadata:</pre></td></tr>
-	<tr class="normal_line"><td><pre>   annotations:</pre></td></tr>
-	<tr class="normal_line"><td><pre>     helm.sh/hook: test</pre></td></tr>
-	<tr class="normal_line"><td><pre>   labels:</pre></td></tr>
-	<tr class="normal_line"><td><pre>     app.kubernetes.io/instance: internal-chart-example</pre></td></tr>
-	<tr class="normal_line"><td><pre>     app.kubernetes.io/managed-by: Helm</pre></td></tr>
-	<tr class="normal_line"><td><pre>     app.kubernetes.io/name: myApp</pre></td></tr>
-	<tr class="normal_line"><td><pre>     app.kubernetes.io/version: 1.16.0</pre></td></tr>
-	<tr class="normal_line"><td><pre>     helm.sh/chart: myApp-0.1.0</pre></td></tr>
-	<tr class="removed_line"><td><pre>-  name: super-app-name-test-connection</pre></td></tr>
-	<tr class="added_line"><td><pre>+  name: new-app-name-test-connection</pre></td></tr>
-	<tr class="normal_line"><td><pre>   namespace: default</pre></td></tr>
-	<tr class="normal_line"><td><pre> spec:</pre></td></tr>
-	<tr class="normal_line"><td><pre>   containers:</pre></td></tr>
-	<tr class="normal_line"><td><pre>   - args:</pre></td></tr>
-	<tr class="removed_line"><td><pre>-    - super-app-name:80</pre></td></tr>
-	<tr class="added_line"><td><pre>+    - new-app-name:80</pre></td></tr>
-	<tr class="normal_line"><td><pre>     command:</pre></td></tr>
-	<tr class="normal_line"><td><pre>     - wget</pre></td></tr>
-	<tr class="normal_line"><td><pre>     image: busybox</pre></td></tr>
-	<tr class="normal_line"><td><pre>     name: wget</pre></td></tr>
-	<tr class="normal_line"><td><pre>   restartPolicy: Never</pre></td></tr>
-</table>
-</div>
-
 <h4 class="resource_header">Service: default/super-app-name → default/new-app-name</h4>
 <div class="diff_container">
 <table>

integration-test/branch-2/target-1/output.md

@@ -3,7 +3,7 @@
 Summary:
 ```yaml
 Modified (1):
-± internal-chart-example (+7|-7)
+± internal-chart-example (+5|-5)
 ```
 
 <details>
@@ -51,32 +51,6 @@ Modified (1):
 -      serviceAccountName: super-app-name
 +      serviceAccountName: new-app-name
 ```
-#### Pod: default/super-app-name-test-connection → default/new-app-name-test-connection
-```diff
- kind: Pod
- metadata:
-   annotations:
-     helm.sh/hook: test
-   labels:
-     app.kubernetes.io/instance: internal-chart-example
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: myApp
-     app.kubernetes.io/version: 1.16.0
-     helm.sh/chart: myApp-0.1.0
--  name: super-app-name-test-connection
-+  name: new-app-name-test-connection
-   namespace: default
- spec:
-   containers:
-   - args:
--    - super-app-name:80
-+    - new-app-name:80
-     command:
-     - wget
-     image: busybox
-     name: wget
-   restartPolicy: Never
-```
 #### Service: default/super-app-name → default/new-app-name
 ```diff
  apiVersion: v1

integration-test/branch-2/target/output.html → integration-test/branch-2/target-2/output.html

@@ -60,7 +60,7 @@ <h1>Argo CD Diff Preview</h1>
 
 <p>Summary:</p>
 <pre>Modified (1):
-± internal-chart-example (+5|-5)</pre>
+± internal-chart-example (+7|-7)</pre>
 
 <div class="diffs">
 <details>
@@ -113,6 +113,36 @@ <h4 class="resource_header">Deployment: default/super-app-name → default/new-a
 </table>
 </div>
 
+<h4 class="resource_header">Pod: default/super-app-name-test-connection → default/new-app-name-test-connection</h4>
+<div class="diff_container">
+<table>
+
+	<tr class="normal_line"><td><pre> kind: Pod</pre></td></tr>
+	<tr class="normal_line"><td><pre> metadata:</pre></td></tr>
+	<tr class="normal_line"><td><pre>   annotations:</pre></td></tr>
+	<tr class="normal_line"><td><pre>     helm.sh/hook: test</pre></td></tr>
+	<tr class="normal_line"><td><pre>   labels:</pre></td></tr>
+	<tr class="normal_line"><td><pre>     app.kubernetes.io/instance: internal-chart-example</pre></td></tr>
+	<tr class="normal_line"><td><pre>     app.kubernetes.io/managed-by: Helm</pre></td></tr>
+	<tr class="normal_line"><td><pre>     app.kubernetes.io/name: myApp</pre></td></tr>
+	<tr class="normal_line"><td><pre>     app.kubernetes.io/version: 1.16.0</pre></td></tr>
+	<tr class="normal_line"><td><pre>     helm.sh/chart: myApp-0.1.0</pre></td></tr>
+	<tr class="removed_line"><td><pre>-  name: super-app-name-test-connection</pre></td></tr>
+	<tr class="added_line"><td><pre>+  name: new-app-name-test-connection</pre></td></tr>
+	<tr class="normal_line"><td><pre>   namespace: default</pre></td></tr>
+	<tr class="normal_line"><td><pre> spec:</pre></td></tr>
+	<tr class="normal_line"><td><pre>   containers:</pre></td></tr>
+	<tr class="normal_line"><td><pre>   - args:</pre></td></tr>
+	<tr class="removed_line"><td><pre>-    - super-app-name:80</pre></td></tr>
+	<tr class="added_line"><td><pre>+    - new-app-name:80</pre></td></tr>
+	<tr class="normal_line"><td><pre>     command:</pre></td></tr>
+	<tr class="normal_line"><td><pre>     - wget</pre></td></tr>
+	<tr class="normal_line"><td><pre>     image: busybox</pre></td></tr>
+	<tr class="normal_line"><td><pre>     name: wget</pre></td></tr>
+	<tr class="normal_line"><td><pre>   restartPolicy: Never</pre></td></tr>
+</table>
+</div>
+
 <h4 class="resource_header">Service: default/super-app-name → default/new-app-name</h4>
 <div class="diff_container">
 <table>

integration-test/branch-2/target/output.md → integration-test/branch-2/target-2/output.md

@@ -3,7 +3,7 @@
 Summary:
 ```yaml
 Modified (1):
-± internal-chart-example (+5|-5)
+± internal-chart-example (+7|-7)
 ```
 
 <details>
@@ -51,6 +51,32 @@ Modified (1):
 -      serviceAccountName: super-app-name
 +      serviceAccountName: new-app-name
 ```
+#### Pod: default/super-app-name-test-connection → default/new-app-name-test-connection
+```diff
+ kind: Pod
+ metadata:
+   annotations:
+     helm.sh/hook: test
+   labels:
+     app.kubernetes.io/instance: internal-chart-example
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: myApp
+     app.kubernetes.io/version: 1.16.0
+     helm.sh/chart: myApp-0.1.0
+-  name: super-app-name-test-connection
++  name: new-app-name-test-connection
+   namespace: default
+ spec:
+   containers:
+   - args:
+-    - super-app-name:80
++    - new-app-name:80
+     command:
+     - wget
+     image: busybox
+     name: wget
+   restartPolicy: Never
+```
 #### Service: default/super-app-name → default/new-app-name
 ```diff
  apiVersion: v1

integration-test/integration_test.go

@@ -109,18 +109,20 @@ var testCases = []TestCase{
 		ArgocdUIURL:        "https://argocd.example.com",
 	},
 	{
-		Name:         "branch-2/target",
+		Name:         "branch-2/target-1",
 		TargetBranch: "integration-test/branch-2/target",
 		BaseBranch:   "integration-test/branch-2/base",
+		Suffix:       "-1",
 	},
 	// Same branches with --include-helm-hooks: the chart's helm test hook Pod is
 	// renamed along with the Deployment and now shows up in the diff.
 	{
-		Name:             "branch-2/target-1",
+		Name:             "branch-2/target-2",
 		TargetBranch:     "integration-test/branch-2/target",
 		BaseBranch:       "integration-test/branch-2/base",
-		Suffix:           "-1",
+		Suffix:           "-2",
 		IncludeHelmHooks: "true",
+		RenderMethod:     "server-api",
 	},
 	{
 		Name:         "branch-3/target",
@@ -375,9 +377,9 @@ var testCases = []TestCase{
 	// "monitoring.coreos.com/v1/ServiceMonitor", which Argo CD includes next to
 	// the group version. The target enables it, so the diff must show it added.
 	{
-		Name:                       "branch-20/target",
-		TargetBranch:               "integration-test/branch-20/target",
-		BaseBranch:                 "integration-test/branch-20/base",
+		Name:                       "branch-21/target",
+		TargetBranch:               "integration-test/branch-21/target",
+		BaseBranch:                 "integration-test/branch-21/base",
 		RenderMethod:               "repo-server-api",
 		ArgocdConfigDir:            "with-servicemonitor-crd-no-cluster-roles",
 		FileRegex:                  "examples/kind-level-capabilities/.*",