feat(validate): warn when a HelmRelease valuesFrom can't be resolved offline (render fidelity)

[devantler]

🤖 Generated by the Daily AI Engineer

Part of #5344 (GitOps shift-left fidelity — render all layers in-process).

Evidence & problem

workload validate/scan render HelmRelease charts offline (default-on) so the actual applied manifests are validated/scanned. Values come from spec.values + spec.valuesFrom ConfigMap/Secret refs resolved from the in-repo stream (pkg/svc/gitops/render/resolver.go). But a valuesFrom reference to a ConfigMap/Secret that isn't in the offline stream — typically a cluster-managed object — is silently dropped (applyValuesFrom, resolver.go !ok return): the chart still renders, but with incomplete values, so the offline output can differ from what Flux applies with no signal to the user. The shift-left gate reports success while its coverage silently diverged from cluster reality.

This is the same honesty gap the existing chart-source degradation channel already closes for chart sources (it warns when a chart source can't be resolved offline) — but it does not yet cover values.

Expected behaviour

When a non-optional valuesFrom reference cannot be resolved from the offline stream, emit a non-fatal warning naming the HelmRelease and the reference, so the user knows the render was partial and can act (vendor the values into the validated source, or mark the ref optional). An optional: true reference is Flux-tolerated (helm-controller ignores a not-found optional ref) and stays silent. No change to pass/fail, exit codes, or rendered output — warning only, on the existing degradation-reporting path.

Acceptance criteria

• A non-optional valuesFrom (ConfigMap or Secret, incl. a specific valuesKey) absent from the offline stream produces a distinct, accurate warning (not the misleading "skipped Helm render … as-is" message).
• An optional: true unresolvable valuesFrom produces no warning.
• A resolvable valuesFrom produces no warning (no regression).
• Applies to both validate and scan (shared render path).
• Tests cover all three states; no behavior change to the validation outcome.

Size: S.

[coderabbitai]

🔗 Related PRs

#5541 - feat(validator): warn when a Talos install-image patch duplicates extensions [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!