xianyun_deploy/deployer/helm/

manager.rs

//! Helm chart deployer manager.
//!
//! Ported from `internal/deployer/helm/manager.go`. The `deployer::Manager`
//! trait impl at the bottom is what lets the orchestrator drive it through
//! the registry.

use serde::Deserialize;
use serde_json::{Map, Value};

use xianyun_backends::helm::Backend as HelmBackend;
use xianyun_core::config::latest::{CaproniConfig, DeployerConfig};

use super::HelmError;
use super::overrider::{merge_values, new_dynamic_overrider, prune_empty};

/// A path together with a cleanup function the caller MUST call
/// once done, e.g. removing a temporary directory or file.
type PathWithCleanup = (String, Box<dyn FnOnce()>);

/// The `--values` CLI arguments together with a cleanup function
/// the caller MUST call once done, e.g. removing a temporary
/// values file.
type ValuesArgsWithCleanup = (Vec<String>, Box<dyn FnOnce()>);

/// Ported from `Manager` in `manager.go`.
pub struct Manager<B: HelmBackend> {
    pub(super) backend: B,
}

impl<B: HelmBackend> Manager<B> {
    /// Ported from `NewManager`. The Go original panics if `backend` is
    /// nil; a Rust `B: HelmBackend` is never null, so that check has no
    /// equivalent here.
    pub fn new(backend: B) -> Self {
        Self { backend }
    }

    /// Ported from `Type`.
    #[must_use]
    pub fn deployer_type(&self) -> &'static str {
        "helm"
    }
}

/// Ported from `helmRepoEntry`: one repository in the output of
/// `helm repo list -o json`.
#[derive(Debug, Clone, Deserialize)]
pub(super) struct HelmRepoEntry {
    pub name: String,
    pub url: String,
}

impl<B: HelmBackend> Manager<B> {
    /// Ported from `getExistingHelmRepos`. `helm repo list` failing (most
    /// commonly because no repositories are configured yet) is treated as
    /// an empty list rather than propagated, matching the Go original's
    /// `//nolint:nilerr` comment. A response that fails to parse as JSON
    /// *is* propagated -- the caller (`registerLockedRepositories`) is the
    /// one that logs and swallows it.
    pub(super) fn get_existing_helm_repos(&self) -> Result<Vec<HelmRepoEntry>, HelmError> {
        let Ok(list_output) = self.backend.repo_list() else {
            return Ok(Vec::new());
        };

        if list_output.is_empty() {
            return Ok(Vec::new());
        }

        serde_json::from_str(&list_output)
            .map_err(|e| HelmError::Io(format!("parsing helm repo list output: {e}")))
    }

    /// Ported from `findHelmRepoByURL`. helm matches by URL and ignores a
    /// trailing slash (`helm pkg/downloader/manager.go`, `hasAllRepos`).
    pub(super) fn find_helm_repo_by_url<'a>(
        &self,
        repos: &'a [HelmRepoEntry],
        repo_url: &str,
    ) -> Option<&'a HelmRepoEntry> {
        let want = repo_url.trim_end_matches('/');

        repos.iter().find(|r| r.url.trim_end_matches('/') == want)
    }

    /// Ported from `buildDynamicOverrides`. Merges every configured dynamic
    /// override into a single tree of Helm values. Later overrides win over
    /// earlier ones. Returns `None` when no override contributes a value.
    ///
    /// `ctx` (Go's `context.Context`, used there only to scope a
    /// `slog.DebugContext` log line) has no parameter here; see
    /// `PORT_NOTES.md`'s note on this crate's explicit-dependency-injection
    /// convention for context-carried values that this session's ported
    /// submodules do not otherwise need.
    ///
    /// # Errors
    ///
    /// Returns an error if an override names an unknown or not-yet-supported
    /// type, or if resolving one fails (an unreadable file, an invalid Helm
    /// key path, or a conflicting key path).
    ///
    /// # Panics
    ///
    /// Panics if `deployer_config.helm` is `None`; callers are expected to
    /// have already checked `deployer_config.deployer_type == "helm"`
    /// (ported from `Manager::Validate`/`Deploy`'s own type check, not yet
    /// wired up here -- see `PORT_NOTES.md`).
    pub fn build_dynamic_overrides(
        &self,
        deployer_config: &DeployerConfig,
        caproni_config: &CaproniConfig,
    ) -> Result<Option<Value>, HelmError> {
        let mut values = Map::new();

        let helm_config = deployer_config
            .helm
            .as_ref()
            .expect("deployer_config.helm must be set for a helm deployer");

        for override_cfg in &helm_config.dynamic_overrides {
            let overrider = new_dynamic_overrider(&override_cfg.override_type)?;

            let Some(override_values) = overrider.get_values(override_cfg, caproni_config)? else {
                continue;
            };

            let Value::Object(override_map) = override_values else {
                continue;
            };

            merge_values(&mut values, override_map);
        }

        prune_empty(&mut values);

        if values.is_empty() {
            return Ok(None);
        }

        Ok(Some(Value::Object(values)))
    }
}

/// A cleanup callback the caller MUST run once it is done with the
/// value it came with, e.g. removing a temporary directory or file.
/// [`DeferGuard`] runs it automatically when it goes out of scope,
/// mirroring Go's `defer cleanup()`.
struct DeferGuard(Option<Box<dyn FnOnce()>>);

impl Drop for DeferGuard {
    fn drop(&mut self) {
        if let Some(f) = self.0.take() {
            f();
        }
    }
}

impl<B: HelmBackend> Manager<B> {
    /// Ported from `Deploy`. Deploys the Helm chart, upgrading it if
    /// already deployed.
    ///
    /// # Errors
    ///
    /// Returns an error if `deployer_config` is not a helm deployer,
    /// preparing the chart source fails, building the values arguments
    /// fails, or the underlying `helm install`/`helm upgrade` call
    /// fails.
    ///
    /// # Panics
    ///
    /// Panics if `deployer_config.helm` is `None`; callers are
    /// expected to have already checked `deployer_config.deployer_type
    /// == "helm"` (this method's own first check).
    pub fn deploy(
        &self,
        deployer_config: &DeployerConfig,
        cfg: &xianyun_core::config::container::Container,
    ) -> Result<(), HelmError> {
        if deployer_config.deployer_type != "helm" {
            return Err(HelmError::NotHelmDeployer);
        }

        let (chart_path, chart_cleanup) =
            self.prepare_chart_source(deployer_config, &cfg.caproni)?;
        let _chart_guard = DeferGuard(Some(chart_cleanup));

        let status = self.status(deployer_config, &cfg.caproni)?;
        let is_deployed = status.state != crate::deployer::State::NotDeployed;

        let (values_args, values_cleanup) = self.build_values_args(deployer_config, cfg)?;
        let _values_guard = DeferGuard(Some(values_cleanup));

        let release_name = self.get_release_name(deployer_config);
        let helm_config = deployer_config
            .helm
            .as_ref()
            .expect("deployer_config.helm must be set for a helm deployer");
        let namespace = helm_config.namespace.clone();
        let mut args = self.build_helm_args(deployer_config, &namespace, &values_args);

        if is_deployed {
            let arg_refs: Vec<&str> = args.iter().map(String::as_str).collect();

            self.backend
                .upgrade(&release_name, &chart_path, &arg_refs)
                .map_err(|e| HelmError::Backend {
                    context: "upgrading helm chart".to_string(),
                    source: e,
                })
        } else {
            args.insert(0, "--create-namespace".to_string());
            let arg_refs: Vec<&str> = args.iter().map(String::as_str).collect();

            self.backend
                .install(&release_name, &chart_path, &arg_refs)
                .map_err(|e| HelmError::Backend {
                    context: "installing helm chart".to_string(),
                    source: e,
                })
        }
    }

    /// Ported from `Status`. `helm list` failing (missing namespace,
    /// helm unavailable, ...) is treated as "not deployed" for
    /// idempotency, matching the Go original's `//nolint:nilerr`
    /// comment -- this method never actually returns `Err`, but keeps
    /// a `Result` return type for parity with the rest of this
    /// module's fallible methods.
    ///
    /// # Errors
    ///
    /// Never returns an error; the signature is `Result` for parity
    /// with the rest of this module.
    ///
    /// # Panics
    ///
    /// Panics if `deployer_config.helm` is `None`.
    pub fn status(
        &self,
        deployer_config: &DeployerConfig,
        _caproni_config: &CaproniConfig,
    ) -> Result<crate::deployer::Status, HelmError> {
        let release_name = self.get_release_name(deployer_config);
        let helm_config = deployer_config
            .helm
            .as_ref()
            .expect("deployer_config.helm must be set for a helm deployer");

        let filter = format!("^{release_name}$");

        let state = match self.backend.list(&helm_config.namespace, &filter) {
            Ok(output) if !output.is_empty() && output != "[]" => crate::deployer::State::Deployed,
            _ => crate::deployer::State::NotDeployed,
        };

        Ok(crate::deployer::Status {
            state,
            deployer_type: "helm".to_string(),
        })
    }

    /// Ported from `Undeploy`. Uninstalls the release if it's deployed,
    /// and does nothing if it isn't, so removing twice is safe.
    ///
    /// # Errors
    ///
    /// Returns [`HelmError::NotHelmDeployer`] if `deployer_config` is not
    /// a helm deployer or has no `helm` block, and a
    /// [`HelmError::Backend`] if `helm uninstall` fails.
    pub fn undeploy(
        &self,
        deployer_config: &DeployerConfig,
        caproni_config: &CaproniConfig,
    ) -> Result<(), HelmError> {
        if deployer_config.deployer_type != "helm" || deployer_config.helm.is_none() {
            return Err(HelmError::NotHelmDeployer);
        }

        let status = self.status(deployer_config, caproni_config)?;
        if status.state == crate::deployer::State::NotDeployed {
            return Ok(());
        }

        let release_name = self.get_release_name(deployer_config);
        let namespace = deployer_config
            .helm
            .as_ref()
            .map(|h| h.namespace.clone())
            .unwrap_or_default();

        tracing::info!(release = %release_name, namespace = %namespace, "removing helm chart");

        self.backend
            .uninstall(&release_name, &namespace)
            .map_err(|e| HelmError::Backend {
                context: "removing helm chart".to_string(),
                source: e,
            })
    }

    /// Ported from `buildValuesArgs`. Assembles the `--values` flags for
    /// `helm install`/`helm upgrade`: the configured values file first,
    /// then a temporary file holding the resolved dynamic overrides, so
    /// overrides win. Returns a cleanup function the caller MUST call.
    fn build_values_args(
        &self,
        deployer_config: &DeployerConfig,
        cfg: &xianyun_core::config::container::Container,
    ) -> Result<ValuesArgsWithCleanup, HelmError> {
        let noop: Box<dyn FnOnce()> = Box::new(|| {});

        let helm_config = deployer_config
            .helm
            .as_ref()
            .expect("deployer_config.helm must be set for a helm deployer");

        let mut values_args = Vec::new();

        if !helm_config.values_file.is_empty() {
            values_args.push("--values".to_string());
            values_args.push(cfg.caproni.resolve_path(&helm_config.values_file));
        }

        let override_values = self.build_dynamic_overrides(deployer_config, &cfg.caproni)?;

        let Some(override_values) = override_values else {
            return Ok((values_args, noop));
        };

        let (override_path, cleanup) = write_values_file(&override_values)?;

        values_args.push("--values".to_string());
        values_args.push(override_path);

        Ok((values_args, cleanup))
    }

    /// Ported from `buildHelmArgs`. Assembles the common CLI arguments
    /// for `helm install`/`helm upgrade`.
    fn build_helm_args(
        &self,
        deployer_config: &DeployerConfig,
        namespace: &str,
        values_args: &[String],
    ) -> Vec<String> {
        let helm_config = deployer_config
            .helm
            .as_ref()
            .expect("deployer_config.helm must be set for a helm deployer");

        let mut args = vec!["--namespace".to_string(), namespace.to_string()];
        args.extend(values_args.iter().cloned());

        if helm_config.wait {
            args.push("--wait".to_string());
        }

        if !helm_config.timeout.is_empty() {
            args.push("--timeout".to_string());
            args.push(helm_config.timeout.clone());
        }

        // Schema validation ensures Version is only set for repo-style
        // charts (requires helm.repository).
        if let Some(release) = helm_config.release.as_ref()
            && !release.version.is_empty()
        {
            args.push("--version".to_string());
            args.push(release.version.clone());
        }

        if deployer_config.edit_mode {
            args.push("--set".to_string());
            args.push("editMode=true".to_string());
        }

        args
    }

    /// Ported from `getReleaseName`. Uses the configured release name if
    /// present, else falls back to the namespace.
    fn get_release_name(&self, deployer_config: &DeployerConfig) -> String {
        let helm_config = deployer_config
            .helm
            .as_ref()
            .expect("deployer_config.helm must be set for a helm deployer");

        if let Some(release) = helm_config.release.as_ref()
            && !release.name.is_empty()
        {
            return release.name.clone();
        }

        helm_config.namespace.clone()
    }

    /// Ported from `prepareChartSource`. Determines the chart reference
    /// to pass to `helm install`/`helm upgrade`.
    ///
    /// Four chart source modes:
    /// 1. Edit mode with repository — uses the local cloned directory
    ///    path.
    /// 2. Repository-based chart — runs `helm repo add`/`update`,
    ///    returns a `repo/chart` reference.
    /// 3. Direct chart reference (OCI, local path, etc.) — returns the
    ///    chart string as-is.
    /// 4. Absolute http(s) URL — fetches the chart and returns a local
    ///    packaged copy.
    ///
    /// Every mode that ends at a chart directory has its dependencies
    /// resolved first, since a chart source tree vendors only its
    /// in-tree subcharts. Modes ending at a repository, a registry, or
    /// an archive are left alone.
    ///
    /// # Errors
    ///
    /// Returns an error if `deployer_config` has no `helm` block, the
    /// repository named by edit mode is not found, `helm.release` is
    /// missing when required, adding/updating the configured helm
    /// repository fails, fetching a URL chart fails, or resolving a
    /// chart's dependencies fails.
    pub fn prepare_chart_source(
        &self,
        deployer_config: &DeployerConfig,
        caproni_config: &CaproniConfig,
    ) -> Result<PathWithCleanup, HelmError> {
        let noop: Box<dyn FnOnce()> = Box::new(|| {});

        let Some(helm_config) = deployer_config.helm.as_ref() else {
            return Err(HelmError::NotHelmDeployer);
        };

        // Mode 1: edit mode with repository reference → local directory
        if let Some(repo_name) = deployer_config.repository.as_ref()
            && deployer_config.edit_mode
        {
            let repo_config = caproni_config
                .repositories
                .as_ref()
                .and_then(|repos| repos.get(repo_name));

            let Some(repo_config) = repo_config else {
                return Err(HelmError::RepositoryNotFound(repo_name.clone()));
            };

            let clone = caproni_config.resolve_path(&repo_config.directory);

            self.resolve_chart_dependencies(std::path::Path::new(&clone))?;

            return Ok((clone, noop));
        }

        // Modes 2 and 3 require helm.release
        let Some(release) = helm_config.release.as_ref() else {
            return Err(HelmError::MissingRelease);
        };

        // Mode 2: helm repository configured → ensure repo is added,
        // return chart reference
        if let Some(repo) = helm_config.repository.as_ref() {
            self.ensure_helm_repository(repo)?;
            return Ok((release.chart.clone(), noop));
        }

        // Mode 4: absolute http(s) URL → fetch it, resolve it, install
        // the copy
        if xianyun_backends::helm::chartref::is_url_chart_ref(&release.chart) {
            let (path, cleanup) = self.materialize_url_chart(&release.chart)?;
            return Ok((path.display().to_string(), cleanup));
        }

        // Mode 3: direct chart reference (OCI URI, local path, etc.) →
        // pass through
        if super::chartdeps::is_chart_directory(&release.chart) {
            self.resolve_chart_dependencies(std::path::Path::new(&release.chart))?;
        }

        Ok((release.chart.clone(), noop))
    }

    /// Ported from `ensureHelmRepository`. Idempotent:
    /// - if the repository exists with the correct URL, it is only
    ///   refreshed,
    /// - if it exists with the wrong URL, it is updated then
    ///   refreshed,
    /// - if it doesn't exist, it is added then refreshed.
    fn ensure_helm_repository(
        &self,
        repo: &xianyun_core::config::latest::HelmRepositoryConfig,
    ) -> Result<(), HelmError> {
        let existing_repos = self.get_existing_helm_repos()?;
        let existing_repo = existing_repos.iter().find(|r| r.name == repo.name);

        match existing_repo {
            Some(existing) if existing.url == repo.url => {}
            Some(_) => self.add_or_update_helm_repo(&repo.name, &repo.url, true)?,
            None => self.add_or_update_helm_repo(&repo.name, &repo.url, false)?,
        }

        self.update_helm_repo(&repo.name)
    }

    /// Ported from `addOrUpdateHelmRepo`.
    fn add_or_update_helm_repo(
        &self,
        name: &str,
        url: &str,
        force_update: bool,
    ) -> Result<(), HelmError> {
        self.backend
            .repo_add(name, url, force_update)
            .map_err(|e| HelmError::Backend {
                context: "adding/updating helm repository".to_string(),
                source: e,
            })
    }

    /// Ported from `updateHelmRepo`.
    fn update_helm_repo(&self, name: &str) -> Result<(), HelmError> {
        self.backend
            .repo_update(name)
            .map_err(|e| HelmError::Backend {
                context: "updating helm repository".to_string(),
                source: e,
            })
    }

    /// Ported from `Validate`. Validates the helm deployer
    /// configuration and referenced files.
    ///
    /// # Errors
    ///
    /// Returns an error if `deployer_config` is not a helm deployer,
    /// `helm.release` is missing when required, `release.version` is
    /// set without `helm.repository`, a dynamic override is invalid,
    /// or a referenced file doesn't exist.
    ///
    /// # Panics
    ///
    /// Never panics: the `deployer_config.helm.is_none()` case is
    /// checked and returned as an error before the `.expect()` below
    /// runs.
    pub fn validate(
        &self,
        deployer_config: &DeployerConfig,
        caproni_config: &CaproniConfig,
    ) -> Result<(), HelmError> {
        if deployer_config.deployer_type != "helm" || deployer_config.helm.is_none() {
            return Err(HelmError::NotHelmDeployer);
        }

        let helm_config = deployer_config
            .helm
            .as_ref()
            .expect("checked deployer_config.helm.is_none() above");

        let edit_mode_with_repository =
            deployer_config.repository.is_some() && deployer_config.edit_mode;

        if !edit_mode_with_repository && helm_config.release.is_none() {
            return Err(HelmError::MissingRelease);
        }

        if let Some(release) = helm_config.release.as_ref()
            && !release.version.is_empty()
            && helm_config.repository.is_none()
        {
            return Err(HelmError::VersionRequiresRepository);
        }

        validate_dynamic_overrides(deployer_config, caproni_config)?;

        validate_helm_paths(deployer_config, caproni_config)
    }
}

/// Ported from `validateDynamicOverrides`.
fn validate_dynamic_overrides(
    deployer_config: &DeployerConfig,
    caproni_config: &CaproniConfig,
) -> Result<(), HelmError> {
    let helm_config = deployer_config
        .helm
        .as_ref()
        .expect("checked deployer_config.helm.is_none() by Validate");

    for override_cfg in &helm_config.dynamic_overrides {
        match override_cfg.override_type.as_str() {
            "gitlab_repo_version_files" => {
                validate_gitlab_repo_version_files(override_cfg, caproni_config)?;
            }
            "inline" | "inline_file" | "release_manifest" => {
                // No validation needed: missing/empty value_map is a
                // noop, and unset environment variable references are
                // skipped at deploy time. release_manifest has no
                // validation of its own yet either (ported as a TODO
                // in the Go original).
            }
            other => {
                return Err(HelmError::UnknownDynamicOverrideType(other.to_string()));
            }
        }
    }

    Ok(())
}

/// Ported from `validateGitLabRepoVersionFiles`.
fn validate_gitlab_repo_version_files(
    override_cfg: &xianyun_core::config::latest::DynamicOverrideConfig,
    caproni_config: &CaproniConfig,
) -> Result<(), HelmError> {
    if override_cfg.repository.is_empty() {
        return Err(HelmError::MissingRepository);
    }

    if override_cfg.version_map.is_empty() {
        return Err(HelmError::MissingVersionMap(
            "gitlab_repo_version_files".to_string(),
        ));
    }

    let version_map_path = caproni_config.resolve_path(&override_cfg.version_map);

    match std::fs::metadata(&version_map_path) {
        Ok(_) => Ok(()),
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
            Err(HelmError::MissingVersionMap(version_map_path))
        }
        Err(e) => Err(HelmError::Io(format!(
            "checking version map path {version_map_path}: {e}"
        ))),
    }
}

/// Ported from `validateHelmPaths`.
fn validate_helm_paths(
    deployer_config: &DeployerConfig,
    caproni_config: &CaproniConfig,
) -> Result<(), HelmError> {
    let helm_config = deployer_config
        .helm
        .as_ref()
        .expect("checked deployer_config.helm.is_none() by Validate");

    if !helm_config.values_file.is_empty() {
        let path = caproni_config.resolve_path(&helm_config.values_file);

        if !std::path::Path::new(&path).exists() {
            return Err(HelmError::ValuesFileNotFound(path));
        }
    }

    Ok(())
}

/// Ported from `writeValuesFile`. Marshals `values` into a temporary
/// values file for helm, and returns its path with a cleanup function
/// the caller MUST call, including on the error paths (the tempfile
/// crate's `TempPath` handles this: it removes the file on drop
/// regardless of how the closure below is invoked).
///
/// The file is created with `0600` permissions (owner read/write
/// only), which the contents require: `inline_file` overrides may
/// carry secret file contents.
fn write_values_file(values: &Value) -> Result<PathWithCleanup, HelmError> {
    use std::io::Write as _;

    let encoded = serde_yaml::to_string(values)
        .map_err(|e| HelmError::Io(format!("encoding helm override values: {e}")))?;

    let mut file = tempfile::Builder::new()
        .prefix("caproni-helm-values-")
        .suffix(".yaml")
        .tempfile()
        .map_err(|e| HelmError::Io(format!("creating helm override values file: {e}")))?;

    file.write_all(encoded.as_bytes())
        .map_err(|e| HelmError::Io(format!("writing helm override values file: {e}")))?;

    let path = file.path().display().to_string();
    let temp_path = file.into_temp_path();

    Ok((path, Box::new(move || drop(temp_path))))
}

/// Lets the orchestrator drive a helm [`Manager`] through the registry.
impl<B: HelmBackend> crate::deployer::Manager for Manager<B> {
    fn deployer_type(&self) -> String {
        "helm".to_string()
    }

    fn deploy(
        &self,
        deployer_config: &DeployerConfig,
        cfg: Option<&xianyun_core::config::container::Container>,
    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        require_helm_block(deployer_config)?;
        let cfg = cfg.ok_or("helm deploy needs the resolved configuration")?;

        Manager::<B>::deploy(self, deployer_config, cfg).map_err(Into::into)
    }

    fn undeploy(
        &self,
        deployer_config: &DeployerConfig,
        caproni_config: &CaproniConfig,
    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        Manager::<B>::undeploy(self, deployer_config, caproni_config).map_err(Into::into)
    }

    fn status(
        &self,
        deployer_config: &DeployerConfig,
        caproni_config: &CaproniConfig,
    ) -> Result<crate::deployer::Status, Box<dyn std::error::Error + Send + Sync>> {
        require_helm_block(deployer_config)?;

        Manager::<B>::status(self, deployer_config, caproni_config).map_err(Into::into)
    }

    fn validate(
        &self,
        deployer_config: &DeployerConfig,
        caproni_config: &CaproniConfig,
    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
        Manager::<B>::validate(self, deployer_config, caproni_config).map_err(Into::into)
    }
}

/// `deploy` and `status` index into the `helm` block and would panic
/// without one, so the trait entry points check for it first.
fn require_helm_block(deployer_config: &DeployerConfig) -> Result<(), HelmError> {
    if deployer_config.deployer_type != "helm" || deployer_config.helm.is_none() {
        return Err(HelmError::NotHelmDeployer);
    }

    Ok(())
}

#[cfg(test)]
mod tests {
    use serde_json::{Value, json};

    use xianyun_core::config::container::{Container, new_container};
    use xianyun_core::config::global::GlobalConfig;
    use xianyun_core::config::latest::{
        CaproniConfig, DeployerConfig, DynamicOverrideConfig, HelmConfig,
    };
    use xianyun_core::orderedmap::OrderedMap;

    use super::super::test_support::MockHelmBackend;
    use super::Manager;

    const TEST_OCI_CHART: &str = "oci://registry.example.com/charts/my-app";

    const SATISFIED_LIST: &str =
        "NAME\tVERSION\tREPOSITORY\tSTATUS\ncert-manager\t1.16.2\thttps://charts.jetstack.io\tok\n";
    const UNSATISFIED_LIST: &str = "NAME\tVERSION\tREPOSITORY\tSTATUS\ncert-manager\t1.16.2\thttps://charts.jetstack.io\tmissing\n";

    /// Ported from `newTestConfig`: a minimal [`Container`] suitable for
    /// use in tests. Provides a valid `Cluster.Network` so the
    /// variables resolver can compute `CAPRONI_PRIMARY_HOSTNAME`.
    fn new_test_config() -> Container {
        new_container(
            GlobalConfig::default(),
            CaproniConfig {
                cluster: xianyun_core::config::types::ClusterConfig {
                    network: Some(xianyun_core::config::types::NetworkConfig {
                        hostname: "test.example.com".to_string(),
                        ..Default::default()
                    }),
                    ..Default::default()
                },
                ..Default::default()
            },
        )
    }

    fn helm_deployer_config(overrides: Vec<DynamicOverrideConfig>) -> DeployerConfig {
        DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                dynamic_overrides: overrides,
                ..Default::default()
            }),
            ..Default::default()
        }
    }

    fn inline_override(value_map: Vec<(&str, Value)>) -> DynamicOverrideConfig {
        let mut map = OrderedMap::new();
        for (k, v) in value_map {
            map.set(k.to_string(), v);
        }

        DynamicOverrideConfig {
            override_type: "inline".to_string(),
            value_map: Some(map),
            ..Default::default()
        }
    }

    // Ported from internal/deployer/helm/manager_test.go:39 (TestType)
    #[test]
    fn test_type() {
        let mgr = Manager::new(MockHelmBackend::new());
        assert_eq!(mgr.deployer_type(), "helm");
    }

    // Ported from internal/deployer/helm/manager_test.go:50 (TestBuildDynamicOverrides_GitLabRepoVersionFiles)
    #[test]
    fn test_build_dynamic_overrides_git_lab_repo_version_files() {
        let mgr = Manager::new(MockHelmBackend::new());

        let manifest_dir = env!("CARGO_MANIFEST_DIR");
        let deployer_config = helm_deployer_config(vec![DynamicOverrideConfig {
            override_type: "gitlab_repo_version_files".to_string(),
            repository: format!("{manifest_dir}/testdata/gitlab/"),
            version_map: format!("{manifest_dir}/testdata/version_map.yaml"),
            ..Default::default()
        }]);

        let caproni_config = CaproniConfig::default();

        let values = mgr
            .build_dynamic_overrides(&deployer_config, &caproni_config)
            .unwrap();

        assert_eq!(
            values,
            Some(json!({
                "gitlab": {"gitaly": {"image": {"tag": "e7e3eae790ac47ed59a7eb82240eb9a74a9421c2"}}},
                "openbao": {"image": {"tag": "v2.4.4-gitlab2"}},
            }))
        );
    }

    // Ported from internal/deployer/helm/manager_test.go:89 (TestBuildDynamicOverrides_GitLabRepoVersionFiles_MissingRepository)
    #[test]
    fn test_build_dynamic_overrides_git_lab_repo_version_files_missing_repository() {
        let mgr = Manager::new(MockHelmBackend::new());

        let manifest_dir = env!("CARGO_MANIFEST_DIR");
        let deployer_config = helm_deployer_config(vec![DynamicOverrideConfig {
            override_type: "gitlab_repo_version_files".to_string(),
            repository: format!("{manifest_dir}/testdata/does-not-exist/"),
            version_map: format!("{manifest_dir}/testdata/version_map.yaml"),
            ..Default::default()
        }]);

        let values = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(values, None);
    }

    // Ported from internal/deployer/helm/manager_test.go:117 (TestBuildDynamicOverrides_Inline)
    #[test]
    fn test_build_dynamic_overrides_inline() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = helm_deployer_config(vec![inline_override(vec![
            ("global.hosts.domain", json!("${CAPRONI_TEST_DOMAIN}")),
            ("global.edition", json!("ce")),
            ("global.tag", json!("v1.2.3")),
        ])]);

        let values = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap();

        // Values are passed through unchanged; ${VAR} resolution happens at
        // config load time, not at override-build time.
        assert_eq!(
            values,
            Some(json!({
                "global": {
                    "edition": "ce",
                    "hosts": {"domain": "${CAPRONI_TEST_DOMAIN}"},
                    "tag": "v1.2.3",
                }
            }))
        );
    }

    // Ported from internal/deployer/helm/manager_test.go:159 (TestBuildDynamicOverrides_InlineTypedValues)
    #[test]
    fn test_build_dynamic_overrides_inline_typed_values() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = helm_deployer_config(vec![inline_override(vec![
            ("global.hosts.gitlab.name", json!("gitlab.example.test")),
            ("global.hosts.gitlab.port", json!(5580)),
            ("global.shell.port", json!(5522)),
            ("global.ingress.tls", json!(false)),
            ("global.replicas", json!(3)),
            ("global.weight", json!(1.5)),
        ])]);

        let values = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(
            values,
            Some(json!({
                "global": {
                    "hosts": {"gitlab": {"name": "gitlab.example.test", "port": 5580}},
                    "ingress": {"tls": false},
                    "replicas": 3,
                    "shell": {"port": 5522},
                    "weight": 1.5,
                }
            }))
        );
    }

    // Ported from internal/deployer/helm/manager_test.go:205 (TestBuildDynamicOverrides_InlineListsAndMaps)
    #[test]
    fn test_build_dynamic_overrides_inline_lists_and_maps() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = helm_deployer_config(vec![inline_override(vec![
            ("global.appConfig", json!({"enabled": true, "count": 3})),
            ("global.gitlab.extraArgs", json!(["--foo", "--bar"])),
            ("global.tag", json!("v1.2.3")),
        ])]);

        let values = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(
            values,
            Some(json!({
                "global": {
                    "appConfig": {"enabled": true, "count": 3},
                    "gitlab": {"extraArgs": ["--foo", "--bar"]},
                    "tag": "v1.2.3",
                }
            }))
        );
    }

    // Ported from internal/deployer/helm/manager_test.go:246 (TestBuildDynamicOverrides_InlineRejectsNonScalarLeaves)
    //
    // **Divergence, not ported (see overrider.rs's module doc comment):**
    // this test exercises a decoded YAML `time.Time` value, which has no
    // equivalent in this crate's `serde_json::Value`-based
    // `DynamicOverrideConfig::value_map` -- every `Value` variant is one
    // `assertOverrideValue`'s Rust port already allows, so the error path
    // this test targets is unreachable here.
    #[test]
    #[ignore = "no Rust equivalent: DynamicOverrideConfig::value_map is serde_json::Value, which has no variant analogous to Go's decoded time.Time (see overrider.rs doc comment)"]
    fn test_build_dynamic_overrides_inline_rejects_non_scalar_leaves() {
        unimplemented!(
            "port of Go TestBuildDynamicOverrides_InlineRejectsNonScalarLeaves from internal/deployer/helm/manager_test.go:246 -- see #[ignore] reason"
        )
    }

    // Ported from internal/deployer/helm/manager_test.go:296 (TestBuildDynamicOverrides_InlineUnsupportedType)
    //
    // **Divergence, not ported:** same reasoning as
    // `test_build_dynamic_overrides_inline_rejects_non_scalar_leaves` above.
    #[test]
    #[ignore = "no Rust equivalent: DynamicOverrideConfig::value_map is serde_json::Value, which has no variant analogous to Go's decoded time.Time (see overrider.rs doc comment)"]
    fn test_build_dynamic_overrides_inline_unsupported_type() {
        unimplemented!(
            "port of Go TestBuildDynamicOverrides_InlineUnsupportedType from internal/deployer/helm/manager_test.go:296 -- see #[ignore] reason"
        )
    }

    // Ported from internal/deployer/helm/manager_test.go:326 (TestBuildDynamicOverrides_InlineFile)
    #[test]
    fn test_build_dynamic_overrides_inline_file() {
        let dir = tempfile::tempdir().unwrap();
        let secret_path = dir.path().join("rails-secret");
        std::fs::write(&secret_path, "s3cret\n").unwrap();

        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = helm_deployer_config(vec![DynamicOverrideConfig {
            override_type: "inline_file".to_string(),
            value_map: Some({
                let mut m = OrderedMap::new();
                m.set(
                    "global.rails.secret".to_string(),
                    json!(secret_path.display().to_string()),
                );
                m
            }),
            ..Default::default()
        }]);

        let values = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(
            values,
            Some(json!({"global": {"rails": {"secret": "s3cret\n"}}}))
        );
    }

    // Ported from internal/deployer/helm/manager_test.go:365 (TestBuildDynamicOverrides_InlineFileMissing)
    #[test]
    fn test_build_dynamic_overrides_inline_file_missing() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = helm_deployer_config(vec![DynamicOverrideConfig {
            override_type: "inline_file".to_string(),
            value_map: Some({
                let mut m = OrderedMap::new();
                m.set("global.literal".to_string(), json!("$CAPRONI_TEST_FILE"));
                m
            }),
            ..Default::default()
        }]);

        let err = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap_err();

        assert!(err.to_string().contains("$CAPRONI_TEST_FILE"));
    }

    // Ported from internal/deployer/helm/manager_test.go:394 (TestBuildDynamicOverrides_MergesOverridesInOrder)
    #[test]
    fn test_build_dynamic_overrides_merges_overrides_in_order() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = helm_deployer_config(vec![
            inline_override(vec![
                ("global.hosts.domain", json!("example.test")),
                ("global.edition", json!("ce")),
            ]),
            inline_override(vec![
                ("global.hosts.gitlab.name", json!("gitlab.example.test")),
                ("global.edition", json!("ee")),
            ]),
        ]);

        let values = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(
            values,
            Some(json!({
                "global": {
                    "edition": "ee",
                    "hosts": {
                        "domain": "example.test",
                        "gitlab": {"name": "gitlab.example.test"},
                    },
                }
            }))
        );
    }

    // Ported from internal/deployer/helm/manager_test.go:440 (TestBuildDynamicOverrides_LaterOverrideReplacesShape)
    #[test]
    fn test_build_dynamic_overrides_later_override_replaces_shape() {
        let mgr = Manager::new(MockHelmBackend::new());

        // subtree replaces scalar
        {
            let deployer_config = helm_deployer_config(vec![
                inline_override(vec![("global.tag", json!("v1.2.3"))]),
                inline_override(vec![("global.tag.suffix", json!("rc1"))]),
            ]);

            let values = mgr
                .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
                .unwrap();

            assert_eq!(values, Some(json!({"global": {"tag": {"suffix": "rc1"}}})));
        }

        // scalar replaces subtree
        {
            let deployer_config = helm_deployer_config(vec![
                inline_override(vec![("global.tag.suffix", json!("rc1"))]),
                inline_override(vec![("global.tag", json!("v1.2.3"))]),
            ]);

            let values = mgr
                .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
                .unwrap();

            assert_eq!(values, Some(json!({"global": {"tag": "v1.2.3"}})));
        }
    }

    // Ported from internal/deployer/helm/manager_test.go:496 (TestBuildDynamicOverrides_NullDropsEarlierValue)
    #[test]
    fn test_build_dynamic_overrides_null_drops_earlier_value() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = helm_deployer_config(vec![
            inline_override(vec![
                ("crds.enabled", json!(true)),
                ("prometheus.enabled", json!(false)),
            ]),
            inline_override(vec![
                ("crds.enabled", Value::Null),
                ("never.set", Value::Null),
                ("extra.enabled", json!(true)),
            ]),
        ]);

        let values = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(
            values,
            Some(json!({
                "prometheus": {"enabled": false},
                "extra": {"enabled": true},
            }))
        );
    }

    // Ported from internal/deployer/helm/manager_test.go:536 (TestBuildDynamicOverrides_NestedNullDropsKey)
    #[test]
    fn test_build_dynamic_overrides_nested_null_drops_key() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = helm_deployer_config(vec![
            inline_override(vec![(
                "global.appConfig",
                json!({"enabled": true, "debug": true}),
            )]),
            inline_override(vec![(
                "global.appConfig",
                json!({"debug": null, "limits": {"cpu": "500m"}}),
            )]),
        ]);

        let values = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(
            values,
            Some(json!({
                "global": {
                    "appConfig": {"enabled": true, "limits": {"cpu": "500m"}},
                }
            }))
        );
    }

    // Ported from internal/deployer/helm/manager_test.go:580 (TestBuildDynamicOverrides_RejectsNullInList)
    #[test]
    fn test_build_dynamic_overrides_rejects_null_in_list() {
        let mgr = Manager::new(MockHelmBackend::new());

        // null list item
        {
            let deployer_config = helm_deployer_config(vec![inline_override(vec![(
                "global.extraArgs",
                json!(["--foo", null]),
            )])]);

            let err = mgr
                .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
                .unwrap_err();
            assert!(matches!(
                err,
                super::HelmError::UnsupportedInlineValueType(..)
            ));
        }

        // null nested in a map inside a list
        {
            let deployer_config = helm_deployer_config(vec![inline_override(vec![(
                "global.servers",
                json!([{"name": null}]),
            )])]);

            let err = mgr
                .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
                .unwrap_err();
            assert!(matches!(
                err,
                super::HelmError::UnsupportedInlineValueType(..)
            ));
        }
    }

    // Ported from internal/deployer/helm/manager_test.go:622 (TestBuildDynamicOverrides_AllValuesNulled)
    #[test]
    fn test_build_dynamic_overrides_all_values_nulled() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = helm_deployer_config(vec![
            inline_override(vec![("crds.enabled", json!(true))]),
            inline_override(vec![("crds.enabled", Value::Null)]),
        ]);

        let values = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(values, None);
    }

    // Ported from internal/deployer/helm/manager_test.go:648 (TestBuildDynamicOverrides_LaterOverrideWinsAcrossTypes)
    #[test]
    fn test_build_dynamic_overrides_later_override_wins_across_types() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = helm_deployer_config(vec![
            inline_override(vec![("global.port", json!("5580"))]),
            inline_override(vec![("global.port", json!(5580))]),
        ]);

        let values = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(values, Some(json!({"global": {"port": 5580}})));
    }

    // Ported from internal/deployer/helm/manager_test.go:675 (TestBuildDynamicOverrides_MapValuesDeepMerge)
    #[test]
    fn test_build_dynamic_overrides_map_values_deep_merge() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = helm_deployer_config(vec![
            inline_override(vec![("global.cfg", json!({"a": 1, "shared": "base"}))]),
            inline_override(vec![("global.cfg", json!({"b": 2, "shared": "overlay"}))]),
            // The dotted form reaches into the same map.
            inline_override(vec![("global.cfg.c", json!(3))]),
        ]);

        let values = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(
            values,
            Some(json!({
                "global": {"cfg": {"a": 1, "b": 2, "c": 3, "shared": "overlay"}}
            }))
        );
    }

    // Ported from internal/deployer/helm/manager_test.go:718 (TestBuildDynamicOverrides_IndexedKeys)
    #[test]
    fn test_build_dynamic_overrides_indexed_keys() {
        let mgr = Manager::new(MockHelmBackend::new());

        // index builds a list
        {
            let deployer_config = helm_deployer_config(vec![inline_override(vec![(
                "ingress.hosts[0]",
                json!("grafana.example.test"),
            )])]);
            let values = mgr
                .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
                .unwrap();
            assert_eq!(
                values,
                Some(json!({"ingress": {"hosts": ["grafana.example.test"]}}))
            );
        }

        // index followed by a key builds a list of maps
        {
            let deployer_config = helm_deployer_config(vec![inline_override(vec![(
                "ingress.hosts[0].name",
                json!("grafana.example.test"),
            )])]);
            let values = mgr
                .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
                .unwrap();
            assert_eq!(
                values,
                Some(json!({"ingress": {"hosts": [{"name": "grafana.example.test"}]}}))
            );
        }

        // sibling indices grow one list
        {
            let deployer_config = helm_deployer_config(vec![inline_override(vec![
                ("ingress.hosts[0]", json!("a.example.test")),
                ("ingress.hosts[1]", json!("b.example.test")),
            ])]);
            let values = mgr
                .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
                .unwrap();
            assert_eq!(
                values,
                Some(json!({"ingress": {"hosts": ["a.example.test", "b.example.test"]}}))
            );
        }

        // a gap is padded with null, as helm does
        {
            let deployer_config = helm_deployer_config(vec![inline_override(vec![(
                "ingress.hosts[2]",
                json!("c.example.test"),
            )])]);
            let values = mgr
                .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
                .unwrap();
            assert_eq!(
                values,
                Some(json!({"ingress": {"hosts": [null, null, "c.example.test"]}}))
            );
        }
    }

    // Ported from internal/deployer/helm/manager_test.go:787 (TestBuildDynamicOverrides_IndexIntoScalar)
    #[test]
    fn test_build_dynamic_overrides_index_into_scalar() {
        let mgr = Manager::new(MockHelmBackend::new());

        // FromMap sorts keys, so "ingress.hosts" is set first.
        let deployer_config = helm_deployer_config(vec![inline_override(vec![
            ("ingress.hosts", json!("a.example.test")),
            ("ingress.hosts[0]", json!("b.example.test")),
        ])]);

        let err = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap_err();

        assert!(matches!(err, super::HelmError::ConflictingHelmKey(_)));
    }

    // Ported from internal/deployer/helm/manager_test.go:816 (TestBuildDynamicOverrides_ConflictingKeyPath)
    #[test]
    fn test_build_dynamic_overrides_conflicting_key_path() {
        let mgr = Manager::new(MockHelmBackend::new());

        // FromMap sorts keys, so "global.tag" is set before it is traversed.
        let deployer_config = helm_deployer_config(vec![inline_override(vec![
            ("global.tag", json!("v1.2.3")),
            ("global.tag.suffix", json!("rc1")),
        ])]);

        let err = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap_err();

        assert!(matches!(err, super::HelmError::ConflictingHelmKey(_)));
    }

    // Ported from internal/deployer/helm/manager_test.go:845 (TestBuildDynamicOverrides_UnknownType)
    #[test]
    fn test_build_dynamic_overrides_unknown_type() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = helm_deployer_config(vec![DynamicOverrideConfig {
            override_type: "unknown_type".to_string(),
            ..Default::default()
        }]);

        let err = mgr
            .build_dynamic_overrides(&deployer_config, &CaproniConfig::default())
            .unwrap_err();

        assert!(matches!(
            err,
            super::HelmError::UnknownDynamicOverrideType(_)
        ));
        assert!(err.to_string().contains("unknown_type"));
    }

    // Ported from internal/deployer/helm/manager_test.go:874 (TestValidate_NoDynamicOverrides)
    #[test]
    fn test_validate_no_dynamic_overrides() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: "my-app".to_string(),
                    chart: "repo/chart".to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        mgr.validate(&deployer_config, &CaproniConfig::default())
            .unwrap();
    }

    // Ported from internal/deployer/helm/manager_test.go:900 (TestValidate_DynamicOverrides_MissingRepository)
    #[test]
    fn test_validate_dynamic_overrides_missing_repository() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: "my-app".to_string(),
                    chart: "repo/chart".to_string(),
                    ..Default::default()
                }),
                dynamic_overrides: vec![DynamicOverrideConfig {
                    override_type: "gitlab_repo_version_files".to_string(),
                    ..Default::default()
                }],
                ..Default::default()
            }),
            ..Default::default()
        };

        let err = mgr
            .validate(&deployer_config, &CaproniConfig::default())
            .unwrap_err();

        assert!(matches!(err, super::HelmError::MissingRepository));
    }

    // Ported from internal/deployer/helm/manager_test.go:931 (TestValidate_DynamicOverrides_MissingVersionMap)
    #[test]
    fn test_validate_dynamic_overrides_missing_version_map() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: "my-app".to_string(),
                    chart: "repo/chart".to_string(),
                    ..Default::default()
                }),
                dynamic_overrides: vec![DynamicOverrideConfig {
                    override_type: "gitlab_repo_version_files".to_string(),
                    repository: "./testdata/gitlab/".to_string(),
                    ..Default::default()
                }],
                ..Default::default()
            }),
            ..Default::default()
        };

        let err = mgr
            .validate(&deployer_config, &CaproniConfig::default())
            .unwrap_err();

        assert!(matches!(err, super::HelmError::MissingVersionMap(_)));
    }

    // Ported from internal/deployer/helm/manager_test.go:963 (TestValidate_InvalidDeployerType)
    #[test]
    fn test_validate_invalid_deployer_type() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = DeployerConfig {
            deployer_type: "skaffold".to_string(),
            ..Default::default()
        };

        let err = mgr
            .validate(&deployer_config, &CaproniConfig::default())
            .unwrap_err();

        assert!(matches!(err, super::HelmError::NotHelmDeployer));
    }

    // Ported from internal/deployer/helm/manager_test.go:980 (TestPrepareChartSource_OCIChart)
    #[test]
    fn test_prepare_chart_source_oci_chart() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: "my-app".to_string(),
                    chart: TEST_OCI_CHART.to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        let (chart_path, _cleanup) = mgr
            .prepare_chart_source(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(chart_path, TEST_OCI_CHART);
    }

    // Ported from internal/deployer/helm/manager_test.go:1004 (TestPrepareChartSource_OCIChartWithTag)
    #[test]
    fn test_prepare_chart_source_oci_chart_with_tag() {
        let mgr = Manager::new(MockHelmBackend::new());

        let oci_chart = "oci://registry.example.com/charts/my-app:1.2.3";
        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: "my-app".to_string(),
                    chart: oci_chart.to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        let (chart_path, _cleanup) = mgr
            .prepare_chart_source(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(chart_path, oci_chart);
    }

    // Ported from internal/deployer/helm/manager_test.go:1029 (TestPrepareChartSource_RepoChart)
    #[test]
    fn test_prepare_chart_source_repo_chart() {
        let backend = MockHelmBackend::new()
            .expect_repo_list(|| Ok("[]".to_string()))
            .expect_repo_add(|name, url, force_update| {
                assert_eq!(name, "gitlab");
                assert_eq!(url, "https://charts.gitlab.io");
                assert!(!force_update);
                Ok(())
            })
            .expect_repo_update(|name| {
                assert_eq!(name, "gitlab");
                Ok(())
            });
        let mgr = Manager::new(backend);

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                repository: Some(xianyun_core::config::latest::HelmRepositoryConfig {
                    name: "gitlab".to_string(),
                    url: "https://charts.gitlab.io".to_string(),
                }),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: "gitlab".to_string(),
                    chart: "gitlab/gitlab".to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        let (chart_path, _cleanup) = mgr
            .prepare_chart_source(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(chart_path, "gitlab/gitlab");
    }

    // Ported from internal/deployer/helm/manager_test.go:1061 (TestPrepareChartSource_MissingRelease)
    #[test]
    fn test_prepare_chart_source_missing_release() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                ..Default::default()
            }),
            ..Default::default()
        };

        let err = match mgr.prepare_chart_source(&deployer_config, &CaproniConfig::default()) {
            Err(e) => e,
            Ok(_) => panic!("expected an error"),
        };

        assert!(matches!(err, super::HelmError::MissingRelease));
    }

    // Ported from internal/deployer/helm/manager_test.go:1080 (TestValidate_MissingRelease)
    #[test]
    fn test_validate_missing_release() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                ..Default::default()
            }),
            ..Default::default()
        };

        let err = mgr
            .validate(&deployer_config, &CaproniConfig::default())
            .unwrap_err();

        assert!(matches!(err, super::HelmError::MissingRelease));
    }

    // Ported from internal/deployer/helm/manager_test.go:1102 (TestDeploy_HelmCLIFlags)
    #[test]
    fn test_deploy_helm_cli_flags() {
        const RELEASE_NAME: &str = "my-app";
        const NAMESPACE: &str = "default";

        struct Case {
            name: &'static str,
            helm: HelmConfig,
            want_args: Vec<&'static str>,
        }

        let cases = vec![
            Case {
                name: "defaults omit wait and timeout",
                helm: HelmConfig {
                    namespace: NAMESPACE.to_string(),
                    ..Default::default()
                },
                want_args: vec!["--create-namespace", "--namespace", NAMESPACE],
            },
            Case {
                name: "wait true passes --wait",
                helm: HelmConfig {
                    namespace: NAMESPACE.to_string(),
                    wait: true,
                    ..Default::default()
                },
                want_args: vec!["--create-namespace", "--namespace", NAMESPACE, "--wait"],
            },
            Case {
                name: "timeout set passes --timeout",
                helm: HelmConfig {
                    namespace: NAMESPACE.to_string(),
                    timeout: "10m".to_string(),
                    ..Default::default()
                },
                want_args: vec![
                    "--create-namespace",
                    "--namespace",
                    NAMESPACE,
                    "--timeout",
                    "10m",
                ],
            },
            Case {
                name: "wait and timeout combined",
                helm: HelmConfig {
                    namespace: NAMESPACE.to_string(),
                    wait: true,
                    timeout: "1h30m".to_string(),
                    ..Default::default()
                },
                want_args: vec![
                    "--create-namespace",
                    "--namespace",
                    NAMESPACE,
                    "--wait",
                    "--timeout",
                    "1h30m",
                ],
            },
        ];

        for case in cases {
            let mut helm = case.helm;
            helm.release = Some(xianyun_core::config::latest::HelmReleaseConfig {
                name: RELEASE_NAME.to_string(),
                chart: TEST_OCI_CHART.to_string(),
                ..Default::default()
            });

            let deployer_config = DeployerConfig {
                deployer_type: "helm".to_string(),
                helm: Some(helm),
                ..Default::default()
            };

            let want_args: Vec<String> = case.want_args.iter().map(|s| s.to_string()).collect();
            let want_args_for_closure = want_args.clone();

            let backend = MockHelmBackend::new()
                .expect_list(move |namespace, filter| {
                    assert_eq!(namespace, NAMESPACE);
                    assert_eq!(filter, format!("^{RELEASE_NAME}$"));
                    Ok("[]".to_string())
                })
                .expect_install(move |release_name, chart_path, args| {
                    assert_eq!(release_name, RELEASE_NAME);
                    assert_eq!(chart_path, TEST_OCI_CHART);
                    assert_eq!(args, want_args_for_closure, "{}", case.name);
                    Ok(())
                });

            let mgr = Manager::new(backend);

            mgr.deploy(&deployer_config, &new_test_config())
                .unwrap_or_else(|e| panic!("{}: {e}", case.name));
        }
    }

    // Ported from internal/deployer/helm/manager_test.go:1181 (TestDeploy_VersionPinning)
    #[test]
    fn test_deploy_version_pinning() {
        const RELEASE_NAME: &str = "gitlab";
        const NAMESPACE: &str = "gitlab";
        const CHART_REF: &str = "gitlab/gitlab";
        const VERSION: &str = "8.9.1";
        const REPO_NAME: &str = "gitlab";
        const REPO_URL: &str = "https://charts.gitlab.io";

        let want_args = vec![
            "--namespace".to_string(),
            NAMESPACE.to_string(),
            "--version".to_string(),
            VERSION.to_string(),
        ];

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: NAMESPACE.to_string(),
                repository: Some(xianyun_core::config::latest::HelmRepositoryConfig {
                    name: REPO_NAME.to_string(),
                    url: REPO_URL.to_string(),
                }),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: RELEASE_NAME.to_string(),
                    chart: CHART_REF.to_string(),
                    version: VERSION.to_string(),
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        // install path
        {
            let mut install_args = vec!["--create-namespace".to_string()];
            install_args.extend(want_args.clone());

            let backend = MockHelmBackend::new()
                .expect_repo_list(|| Ok("[]".to_string()))
                .expect_repo_add(|name, url, force_update| {
                    assert_eq!(name, REPO_NAME);
                    assert_eq!(url, REPO_URL);
                    assert!(!force_update);
                    Ok(())
                })
                .expect_repo_update(|name| {
                    assert_eq!(name, REPO_NAME);
                    Ok(())
                })
                .expect_list(|namespace, filter| {
                    assert_eq!(namespace, NAMESPACE);
                    assert_eq!(filter, format!("^{RELEASE_NAME}$"));
                    Ok("[]".to_string())
                })
                .expect_install(move |release_name, chart_path, args| {
                    assert_eq!(release_name, RELEASE_NAME);
                    assert_eq!(chart_path, CHART_REF);
                    assert_eq!(args, install_args);
                    Ok(())
                });

            let mgr = Manager::new(backend);
            mgr.deploy(&deployer_config, &new_test_config()).unwrap();
        }

        // upgrade path
        {
            let upgrade_args = want_args.clone();

            let backend = MockHelmBackend::new()
                .expect_repo_list(|| {
                    Ok(r#"[{"name":"gitlab","url":"https://charts.gitlab.io"}]"#.to_string())
                })
                .expect_repo_update(|name| {
                    assert_eq!(name, REPO_NAME);
                    Ok(())
                })
                .expect_list(|namespace, filter| {
                    assert_eq!(namespace, NAMESPACE);
                    assert_eq!(filter, format!("^{RELEASE_NAME}$"));
                    Ok(r#"[{"name":"gitlab"}]"#.to_string())
                })
                .expect_upgrade(move |release_name, chart_path, args| {
                    assert_eq!(release_name, RELEASE_NAME);
                    assert_eq!(chart_path, CHART_REF);
                    assert_eq!(args, upgrade_args);
                    Ok(())
                });

            let mgr = Manager::new(backend);
            mgr.deploy(&deployer_config, &new_test_config()).unwrap();
        }
    }

    /// Ported from `lastValuesArg`: returns the path given to the final
    /// `--values` flag in `args`.
    fn last_values_arg(args: &[String]) -> String {
        for i in (0..args.len().saturating_sub(1)).rev() {
            if args[i] == "--values" {
                return args[i + 1].clone();
            }
        }

        panic!("no --values flag in {args:?}");
    }

    // Ported from internal/deployer/helm/manager_test.go:1262 (TestDeploy_DynamicOverridesValuesFile)
    #[test]
    fn test_deploy_dynamic_overrides_values_file() {
        const RELEASE_NAME: &str = "my-app";
        const NAMESPACE: &str = "default";

        let temp_dir = tempfile::tempdir().unwrap();
        let configured_values = temp_dir.path().join("values.yaml");
        std::fs::write(&configured_values, "{}\n").unwrap();
        let configured_values = configured_values.display().to_string();

        let mut value_map = OrderedMap::new();
        value_map.set("global.hosts.domain".to_string(), json!("example.test"));

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: NAMESPACE.to_string(),
                values_file: configured_values.clone(),
                wait: true,
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: RELEASE_NAME.to_string(),
                    chart: TEST_OCI_CHART.to_string(),
                    ..Default::default()
                }),
                dynamic_overrides: vec![DynamicOverrideConfig {
                    override_type: "inline".to_string(),
                    value_map: Some(value_map),
                    ..Default::default()
                }],
                ..Default::default()
            }),
            ..Default::default()
        };

        let got_args: std::sync::Arc<std::sync::Mutex<Vec<String>>> =
            std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
        let override_yaml: std::sync::Arc<std::sync::Mutex<Vec<u8>>> =
            std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));

        let got_args_clone = got_args.clone();
        let override_yaml_clone = override_yaml.clone();

        let backend = MockHelmBackend::new()
            .expect_list(|namespace, filter| {
                assert_eq!(namespace, NAMESPACE);
                assert_eq!(filter, format!("^{RELEASE_NAME}$"));
                Ok("[]".to_string())
            })
            .expect_install(move |release_name, chart_path, args| {
                assert_eq!(release_name, RELEASE_NAME);
                assert_eq!(chart_path, TEST_OCI_CHART);

                *got_args_clone.lock().unwrap() = args.to_vec();

                let override_path = last_values_arg(args);
                *override_yaml_clone.lock().unwrap() =
                    std::fs::read(&override_path).expect("reading override values file");

                Ok(())
            });

        let mgr = Manager::new(backend);
        mgr.deploy(&deployer_config, &new_test_config()).unwrap();

        let got_args = got_args.lock().unwrap().clone();
        let override_path = last_values_arg(&got_args);

        assert_eq!(
            got_args,
            vec![
                "--create-namespace".to_string(),
                "--namespace".to_string(),
                NAMESPACE.to_string(),
                "--values".to_string(),
                configured_values,
                "--values".to_string(),
                override_path.clone(),
                "--wait".to_string(),
            ]
        );

        let decoded: Value = serde_yaml::from_slice(&override_yaml.lock().unwrap()).unwrap();
        assert_eq!(
            decoded,
            json!({
                "global": {
                    "hosts": {"domain": "example.test"},
                },
            })
        );

        assert!(
            !std::path::Path::new(&override_path).exists(),
            "the override file should be removed once the deploy finishes"
        );
    }

    // Ported from internal/deployer/helm/manager_test.go:1343 (TestWriteValuesFile_IsNotWorldReadable)
    #[test]
    fn test_write_values_file_is_not_world_readable() {
        let (path, cleanup) = super::write_values_file(&json!({"secret": "s3cret"})).unwrap();

        let metadata = std::fs::metadata(&path).unwrap();

        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt as _;
            assert_eq!(metadata.permissions().mode() & 0o777, 0o600);
        }

        cleanup();
    }

    // Ported from internal/deployer/helm/manager_test.go:1358 (TestValidate_VersionWithoutRepository)
    #[test]
    fn test_validate_version_without_repository() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: "my-app".to_string(),
                    chart: "oci://registry.example.com/charts/my-app".to_string(),
                    version: "1.2.3".to_string(),
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        let err = mgr
            .validate(&deployer_config, &CaproniConfig::default())
            .unwrap_err();

        assert!(matches!(err, super::HelmError::VersionRequiresRepository));
    }

    // Ported from internal/deployer/helm/manager_test.go:1380 (TestValidate_MissingRelease_EditModeOK)
    #[test]
    fn test_validate_missing_release_edit_mode_ok() {
        let mgr = Manager::new(MockHelmBackend::new());

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            repository: Some("my-chart".to_string()),
            edit_mode: true,
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                ..Default::default()
            }),
            ..Default::default()
        };

        mgr.validate(&deployer_config, &CaproniConfig::default())
            .unwrap();
    }

    /// Stands in for helm, writing the chart directory plus the empty
    /// one helm leaves beside it, and recording where it unpacked.
    /// Ported from `stubPull`/`stubPullFor`.
    fn stub_pull_for(
        chart_ref: &'static str,
        dirs: std::sync::Arc<std::sync::Mutex<Vec<String>>>,
    ) -> MockHelmBackend {
        MockHelmBackend::new().expect_pull(move |got_chart_ref, untar_dir| {
            assert_eq!(got_chart_ref, chart_ref);

            dirs.lock().unwrap().push(untar_dir.to_string());

            std::fs::create_dir_all(format!("{untar_dir}/gitlab")).unwrap();
            std::fs::write(format!("{untar_dir}/gitlab/Chart.yaml"), "name: gitlab\n").unwrap();

            Ok(())
        })
    }

    // Ported from internal/deployer/helm/manager_test.go:1402 (TestPrepareChartSource_URLChartIsFetched)
    #[test]
    fn test_prepare_chart_source_url_chart_is_fetched() {
        const TEST_CHART_URL: &str = "https://gitlab.com/g/p/-/archive/abc123/p-abc123.tar.gz";

        let dirs = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
        let backend = stub_pull_for(TEST_CHART_URL, dirs)
            .expect_dependency_list(|_| Ok(SATISFIED_LIST.to_string()));

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: "gitlab".to_string(),
                    chart: TEST_CHART_URL.to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        let mgr = Manager::new(backend);
        let (chart_path, cleanup) = mgr
            .prepare_chart_source(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_ne!(
            chart_path, TEST_CHART_URL,
            "helm should be given the fetched chart, not the URL"
        );
        assert!(
            std::path::Path::new(&chart_path)
                .join("Chart.yaml")
                .is_file()
        );

        cleanup();
    }

    // Ported from internal/deployer/helm/manager_test.go:1428 (TestPrepareChartSource_URLChartWithAnUppercaseScheme)
    #[test]
    fn test_prepare_chart_source_url_chart_with_an_uppercase_scheme() {
        const CHART: &str = "HTTPS://gitlab.com/g/p/-/archive/abc123/p-abc123.tar.gz";

        let dirs = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
        let backend =
            stub_pull_for(CHART, dirs).expect_dependency_list(|_| Ok(SATISFIED_LIST.to_string()));

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: "gitlab".to_string(),
                    chart: CHART.to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        let mgr = Manager::new(backend);
        let (chart_path, cleanup) = mgr
            .prepare_chart_source(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert!(
            std::path::Path::new(&chart_path)
                .join("Chart.yaml")
                .is_file()
        );

        cleanup();
    }

    // Ported from internal/deployer/helm/manager_test.go:1455 (TestPrepareChartSource_ConfiguredRepositoryWinsOverAURLChart)
    #[test]
    fn test_prepare_chart_source_configured_repository_wins_over_aurl_chart() {
        const TEST_CHART_URL: &str = "https://gitlab.com/g/p/-/archive/abc123/p-abc123.tar.gz";

        // helm.repository means the chart is a repo/chart reference,
        // not a fetch.
        let backend = MockHelmBackend::new()
            .expect_repo_list(|| Ok("[]".to_string()))
            .expect_repo_add(|name, url, force_update| {
                assert_eq!(name, "gitlab");
                assert_eq!(url, "https://charts.gitlab.io");
                assert!(!force_update);
                Ok(())
            })
            .expect_repo_update(|name| {
                assert_eq!(name, "gitlab");
                Ok(())
            });

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                repository: Some(xianyun_core::config::latest::HelmRepositoryConfig {
                    name: "gitlab".to_string(),
                    url: "https://charts.gitlab.io".to_string(),
                }),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: "gitlab".to_string(),
                    chart: TEST_CHART_URL.to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        let mgr = Manager::new(backend);
        let (chart_path, _cleanup) = mgr
            .prepare_chart_source(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(chart_path, TEST_CHART_URL);
    }

    // Ported from internal/deployer/helm/manager_test.go:1483 (TestPrepareChartSource_EditModeResolvesTheClonesDependencies)
    #[test]
    fn test_prepare_chart_source_edit_mode_resolves_the_clones_dependencies() {
        const TEST_REPO_URL: &str = "https://charts.jetstack.io";

        // A source clone carries its in-tree subcharts and nothing
        // else.
        let clone_dir = tempfile::tempdir().unwrap();
        let clone = clone_dir.path().display().to_string();
        std::fs::write(clone_dir.path().join("Chart.yaml"), "name: gitlab\n").unwrap();
        std::fs::write(
            clone_dir.path().join("Chart.lock"),
            format!(
                "dependencies:\n- name: cert-manager\n  repository: {TEST_REPO_URL}\n  version: 1.16.2\n"
            ),
        )
        .unwrap();

        let repo_name_for_chart = super::super::chartdeps::chart_repo_name(TEST_REPO_URL);

        let clone_for_dep_list = clone.clone();
        let clone_for_dep_build = clone.clone();

        let backend = MockHelmBackend::new()
            .expect_dependency_list(move |chart_dir| {
                assert_eq!(chart_dir, clone_for_dep_list);
                Ok(UNSATISFIED_LIST.to_string())
            })
            .expect_repo_list(|| Ok("[]".to_string()))
            .expect_repo_add(move |name, url, force_update| {
                assert_eq!(name, repo_name_for_chart);
                assert_eq!(url, TEST_REPO_URL);
                assert!(force_update);
                Ok(())
            })
            .expect_dependency_build(move |chart_dir, skip_refresh| {
                assert_eq!(chart_dir, clone_for_dep_build);
                assert!(skip_refresh);
                Ok(())
            });

        let repo_name = "gitlab-chart".to_string();
        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            repository: Some(repo_name.clone()),
            edit_mode: true,
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                ..Default::default()
            }),
            ..Default::default()
        };

        let mut repositories = OrderedMap::new();
        repositories.set(
            repo_name,
            xianyun_core::config::latest::RepositoryConfig {
                repository: "https://gitlab.com/gitlab-org/charts/gitlab.git".to_string(),
                directory: clone.clone(),
                ..Default::default()
            },
        );
        let caproni_config = CaproniConfig {
            repositories: Some(repositories),
            ..Default::default()
        };

        let mgr = Manager::new(backend);
        let (chart_path, _cleanup) = mgr
            .prepare_chart_source(&deployer_config, &caproni_config)
            .unwrap();

        assert_eq!(chart_path, clone);
    }

    // Ported from internal/deployer/helm/manager_test.go:1524 (TestPrepareChartSource_LocalChartDirectoryIsResolvedInPlace)
    #[test]
    fn test_prepare_chart_source_local_chart_directory_is_resolved_in_place() {
        let chart_dir = tempfile::tempdir().unwrap();
        std::fs::write(chart_dir.path().join("Chart.yaml"), "name: my-app\n").unwrap();
        let chart_dir_path = chart_dir.path().display().to_string();

        let chart_dir_for_dep_list = chart_dir_path.clone();
        let chart_dir_for_dep_build = chart_dir_path.clone();

        let backend = MockHelmBackend::new()
            .expect_dependency_list(move |dir| {
                assert_eq!(dir, chart_dir_for_dep_list);
                Ok(UNSATISFIED_LIST.to_string())
            })
            .expect_repo_list(|| Ok("[]".to_string()))
            .expect_repo_add(|_, _, _| Ok(()))
            .expect_dependency_build(move |dir, skip_refresh| {
                assert_eq!(dir, chart_dir_for_dep_build);
                assert!(skip_refresh);
                Ok(())
            });

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: "my-app".to_string(),
                    chart: chart_dir_path.clone(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        let mgr = Manager::new(backend);
        let (chart_path, _cleanup) = mgr
            .prepare_chart_source(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(chart_path, chart_dir_path);
    }

    // Ported from internal/deployer/helm/manager_test.go:1549 (TestPrepareChartSource_LocalPackagedChartIsPassedThrough)
    #[test]
    fn test_prepare_chart_source_local_packaged_chart_is_passed_through() {
        let temp_dir = tempfile::tempdir().unwrap();
        let packaged = temp_dir.path().join("my-app-1.0.0.tgz");
        std::fs::write(&packaged, "packaged chart").unwrap();
        let packaged = packaged.display().to_string();

        // helm cannot resolve dependencies into an archive, so nothing
        // to probe.
        let backend = MockHelmBackend::new();

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "default".to_string(),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: "my-app".to_string(),
                    chart: packaged.clone(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        let mgr = Manager::new(backend);
        let (chart_path, _cleanup) = mgr
            .prepare_chart_source(&deployer_config, &CaproniConfig::default())
            .unwrap();

        assert_eq!(chart_path, packaged);
    }

    // Ported from internal/deployer/helm/manager.go `Undeploy`, which the
    // Go suite covered only indirectly.
    fn undeploy_config(release: &str) -> DeployerConfig {
        DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                namespace: "apps".to_string(),
                release: Some(xianyun_core::config::latest::HelmReleaseConfig {
                    name: release.to_string(),
                    chart: "oci://registry.example.com/charts/my-app".to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        }
    }

    #[test]
    fn test_undeploy_uninstalls_a_deployed_release() {
        let uninstalled = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
        let seen = uninstalled.clone();
        let backend = MockHelmBackend::new()
            .expect_list(|namespace, filter| {
                assert_eq!(namespace, "apps");
                assert_eq!(filter, "^my-app$");
                Ok("[{\"name\":\"my-app\"}]".to_string())
            })
            .expect_uninstall(move |release, namespace| {
                seen.lock()
                    .unwrap()
                    .push((release.to_string(), namespace.to_string()));
                Ok(())
            });

        Manager::new(backend)
            .undeploy(&undeploy_config("my-app"), &CaproniConfig::default())
            .unwrap();

        assert_eq!(
            *uninstalled.lock().unwrap(),
            vec![("my-app".to_string(), "apps".to_string())]
        );
    }

    #[test]
    fn test_undeploy_is_a_no_op_when_the_release_is_not_deployed() {
        // No expect_uninstall: the mock panics if uninstall is called.
        let backend = MockHelmBackend::new().expect_list(|_, _| Ok("[]".to_string()));

        Manager::new(backend)
            .undeploy(&undeploy_config("my-app"), &CaproniConfig::default())
            .unwrap();
    }

    #[test]
    fn test_undeploy_reports_an_uninstall_failure() {
        let backend = MockHelmBackend::new()
            .expect_list(|_, _| Ok("[{\"name\":\"my-app\"}]".to_string()))
            .expect_uninstall(|_, _| Err(xianyun_executor::exec::ExecError::CommandFailed(1)));

        let err = Manager::new(backend)
            .undeploy(&undeploy_config("my-app"), &CaproniConfig::default())
            .unwrap_err();

        assert!(
            err.to_string().contains("removing helm chart"),
            "error should say what failed: {err}"
        );
    }

    #[test]
    fn test_undeploy_rejects_a_non_helm_deployer() {
        let err = Manager::new(MockHelmBackend::new())
            .undeploy(
                &DeployerConfig {
                    deployer_type: "kustomize".to_string(),
                    ..Default::default()
                },
                &CaproniConfig::default(),
            )
            .unwrap_err();

        assert!(matches!(err, super::super::HelmError::NotHelmDeployer));
    }
}