fix: helm-only release is a no-op when chart name lacks helm- prefix

[Copilot]

Chart names are stored internally with a helm- prefix (e.g., helm-manmanv2-control-services), but by convention workflow inputs omit it (e.g., manmanv2-control-services). Both plan_helm_release and find_helm_chart_bazel_target used exact-string matching, so user-provided names never matched, producing an empty plan and silently skipping all build/publish steps.

Changes

• cli.py — plan_helm_release: matching now also checks c['name'] == f"helm-{req}", accepting names with or without the prefix
• helm.py — find_helm_chart_bazel_target: same prefix-aware matching applied to the lower-level lookup used by build-helm-chart
• test_exclude_demo.py: added TestPlanHelmReleaseChartNameMatching (4 cases) and TestFindHelmChartBazelTargetNameMatching (3 cases) covering both name forms, mixed input, and unknown chart behavior

# Before: only exact match
matching = [c for c in all_charts if c['name'] == req or c['domain'] == req]

# After: also matches name without "helm-" prefix
matching = [
    c for c in all_charts
    if c['name'] == req or c['domain'] == req or c['name'] == f"helm-{req}"
]

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• pigweed.googlesource.com
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin REDACTED (dns block)
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin REDACTED -collect-logs (dns block)
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin REDACTED rything (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[QMasterMoo]

@copilot I have fixed the firewall, try again without go build/test

[Copilot]

@copilot I have fixed the firewall, try again without go build/test

Tests now run successfully with Bazel:

• //tools/release_helper:test_exclude_demo — PASSED ✅ (all 14 tests, including the 7 new prefix-matching tests)
• //tools/release_helper:test_helm_app_versions — FAILED ❌ (test_resolve_versions_with_released_versions — pre-existing failure confirmed present before my changes)

Note: bazel test needs --server_javabase=/usr/lib/jvm/temurin-21-jdk-amd64 on this runner to pick up the proxy's CA cert (Bazel 8.3.1 requires Java 21+). The CI runner should work fine as the MITM cert is already in the system Java trust stores.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• telemetry2.aspect.build
  • Triggering command: /usr/bin/curl /usr/bin/curl --location --max-time 1 --connect-timeout 0.5 --request POST --post302 --header Content-Type:application/json --data @report.json REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)