[Bug] --three-way-merge fails when using OCI charts due to OCI pull output leaking into manifest buffer

[frittentheke]

Description:

When using helm diff upgrade --three-way-merge with an OCI-hosted chart or subchart, Helm's OCI pull progress log is written to stdout and included in the rendered release manifest buffer.

When manifest/generate.go passes this buffer to kubeClient.Build(), Kubernetes fails to unmarshal the OCI log JSON because it lacks a Kind.

Steps to Reproduce:

• Reference an OCI chart (e.g., public.ecr.aws/karpenter/karpenter) directly or as a subchart dependency.

• Run e.g. helm diff upgrade --debug --normalize-manifests --install --three-way-merge --version 1.9.0 --namespace karpenter karpenter oci://public.ecr.aws/karpenter/karpenter

• Observe error:

llevel=DEBUG msg="executing plugin command" pluginName=diff command="/home/crohmann/.local/share/helm/plugins/helm-diff/bin/diff upgrade --normalize-manifests --install --three-way-merge --version 1.9.0 karpenter oci://public.ecr.aws/karpenter/karpenter"
Executing helm version
Executing helm get manifest karpenter --namespace karpenter
Executing helm get values karpenter --output yaml --all --namespace karpenter
Executing helm version
Executing helm version
Executing helm version
Executing helm version
Executing helm template karpenter oci://public.ecr.aws/karpenter/karpenter --version 1.9.0 --namespace karpenter --values /tmp/existing-values4265984746 --dry-run=server --is-upgrade
Error: unable to generate manifests: unable to build kubernetes objects from new release manifest: unable to decode "": Object 'Kind' is missing in '{"Digest":"sha256:8e3952caafd208cb888fbf97467cd04a4a024a3fba64c84af73039040cc6a371","Pulled":"public.ecr.aws/karpenter/karpenter:1.9.0"}'
level=DEBUG msg="plugin execution failed" pluginName=diff error="exit status 1" exitCode=1 stderr=""
Error: plugin "diff" exited with error

• Manually calling helm template karpenter oci://public.ecr.aws/karpenter/karpenter --version 1.9.0 --namespace karpenter --values /tmp/values.yaml --dry-run=server --is-upgrade

shows the pull info that helm diff complains about right at the beginning:

Pulled: public.ecr.aws/karpenter/karpenter:1.9.0
Digest: sha256:8e3952caafd208cb888fbf97467cd04a4a024a3fba64c84af73039040cc6a371
level=WARN msg="This chart or one of its subcharts contains CRDs. Rendering may fail or contain inaccuracies."
---
# Source: karpenter/templates/poddisruptionbudget.yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: karpenter
  namespace: karpenter

[...]

• switching to dry-run mode (not using helm template) via HELM_DIFF_USE_UPGRADE_DRY_RUN=true helm diff upgrade --debug --normalize-manifests --install --three-way-merge --version 1.9.0 --namespace karpenter karpenter oci://public.ecr.aws/karpenter/karpenteralso works:

level=DEBUG msg="executing plugin command" pluginName=diff command="/home/crohmann/.local/share/helm/plugins/helm-diff/bin/diff upgrade --normalize-manifests --install --three-way-merge --version 1.9.0 karpenter oci://public.ecr.aws/karpenter/karpenter"
Executing helm version
Executing helm get manifest karpenter --namespace karpenter
Executing helm get values karpenter --output yaml --all --namespace karpenter
Executing helm version
Executing helm version
Executing helm upgrade karpenter oci://public.ecr.aws/karpenter/karpenter --version 1.9.0 --namespace karpenter --values /tmp/existing-values4084653059 --server-side=auto --install --dry-run=server

Expected Behavior / Idea for a bugfix

helm-diff should strip OCI pull output before passing the manifest buffer to kubeClient.Build() in (

helm-diff/manifest/generate.go

Lines 32 to 35 in 01d88c2

	target, err := actionConfig.KubeClient.Build(bytes.NewBuffer(targetManifest), false)
	if err != nil {
	return nil, nil, fmt.Errorf("unable to build kubernetes objects from new release manifest: %w", err)
	}

)