@olivervea/pipelines 2.0.0-beta.7 → 2.0.0-beta.9

package/src/library/helm-deploy-ssh.ts

@@ -3,22 +3,21 @@
 //
 // Ported from v1's olve-lib.sh (olve_ssh_host, olve_image_import, olve_helm_deploy) and
 // deploy-beta.sh (rollout wait + health loop); the footguns are kept as comments below.
-import { existsSync, statSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import type { Ctx } from "../ctx/types.ts";
 import type { FileRef } from "../core/models.ts";
 import type { Secret } from "../core/secrets.ts";
 import type { Configurable } from "../core/config.ts";
-import { recordConfigRefs, resolveConfigRefs } from "../core/config-refs.ts";
-import { makeStep, type LibraryStep, type LiteralName, type Step } from "../core/steps.ts";
+import { resolveConfigRefs } from "../core/config-refs.ts";
+import { implement, type Implementation } from "../core/handlers.ts";
+import { step, type LiteralName, type Step } from "../core/steps.ts";
 import type { Simplify } from "../core/types.ts";
 import { httpHealthCheck, type HttpHealthCheckOptions } from "./http-health.ts";
 import { BuiltImage, HelmRelease, PushedImage, Source } from "./models.ts";
 import { shq, sshSession } from "./ssh.ts";
 import { helmDeployOverSshTarget, type HelmDeploySshTargetDef, type HelmTargetDeployInput } from "./helm-deploy.ts";
 
-export { shq } from "./ssh.ts";
-
 /** Alpine: `apk add openssh-client` at run time gives ssh/scp (the health check runs in the harness). */
 export const HELM_DEPLOY_IMAGE = "alpine:3.22";
 
@@ -71,7 +70,7 @@ export interface HelmDeployOverSshDef<
   /**
    * The images to deploy: step input key → the chart's values prefix for that image. Each input is a
    * `BuiltImage` (or `PushedImage` with `fromRegistry`). Default `{ image: "image" }`; several images
-   * need a mapper, e.g. `{ server: "image", web: "web.image" }`.
+   * need a mapper, e.g. `{ server: "image", web: "web.image" }`. `{}` deploys the chart alone.
    */
   images?: Im & { readonly source?: never };
   /**
@@ -87,10 +86,20 @@ export interface HelmDeployOverSshDef<
    * next to tarball `images`.
    */
   imageRefs?: Rf & { readonly source?: never };
-  /** Rollouts to wait for, in order: `deploy/<name>` for a bare name. Default: the release name. */
+  /** Rollouts to wait for, in order: `deploy/<name>` for a bare name. Default: the release name, or none without images or with helm's wait. */
   deployments?: readonly string[];
-  /** Per rollout (`kubectl rollout status --timeout`). Default 120. */
+  /** Per rollout (`kubectl rollout status --timeout`), or for helm's own wait. Default 120. */
   rolloutTimeoutSeconds?: number;
+  /**
+   * Pull the dependencies `Chart.yaml` lists (`charts/` is usually not committed) into the chart on the
+   * host before installing: `helm pull <name> --repo <repository> --version <version>`, or the `oci://`
+   * reference. Default false.
+   */
+  dependencies?: boolean;
+  /** `helm upgrade --wait`: helm waits for all of the release's resources to be ready. Default false. */
+  helmWait?: boolean;
+  /** `helm upgrade --atomic`: wait like `helmWait`, and roll back when the upgrade fails. Default false. */
+  atomic?: boolean;
   /** After the rollouts, GET this URL until it returns 2xx (`httpHealthCheck`: 5 × 5 s unless given), or fail the step. */
   healthUrl?: Configurable<string> | ({ url: Configurable<string> } & Pick<HttpHealthCheckOptions, "attempts" | "delaySeconds">);
   timeoutSeconds?: number;
@@ -144,15 +153,45 @@ export function helmFlags(o: HelmFlagOptions): string[] {
 }
 
 /** Remote `helm upgrade --install`, run from inside the copied chart directory. */
-export function helmUpgradeCommand(o: HelmFlagOptions & { remoteChart: string; release: string; namespace: string }): string {
+export function helmUpgradeCommand(o: HelmFlagOptions & { remoteChart: string; release: string; namespace: string; wait?: HelmWait }): string {
   const flags = helmFlags(o);
+  const wait = o.wait ? [o.wait.atomic ? "--atomic" : "--wait", `--timeout=${o.wait.timeoutSeconds}s`] : [];
   return [
     `cd ${shq(o.remoteChart)}`,
-    ["helm", "upgrade", "--install", o.release, ".", "-n", o.namespace, ...flags].map(shq).join(" "),
+    ["helm", "upgrade", "--install", o.release, ".", "-n", o.namespace, ...flags, ...wait].map(shq).join(" "),
     `cd / && rm -rf ${shq(o.remoteChart)}`,
   ].join(" && ");
 }
 
+/** helm's own wait (`--wait`, or `--atomic` to roll back on failure). */
+export interface HelmWait {
+  atomic: boolean;
+  timeoutSeconds: number;
+}
+
+/** A dependency from `Chart.yaml`. */
+export interface ChartDependency {
+  name: string;
+  version: string;
+  repository: string;
+}
+
+/** The dependencies `<chartDir>/Chart.yaml` lists, checked to be pullable (an http(s) or oci repository). */
+export function chartDependencies(chartDir: string): ChartDependency[] {
+  const chart = Bun.YAML.parse(readFileSync(join(chartDir, "Chart.yaml"), "utf8")) as { dependencies?: Partial<ChartDependency>[] } | null;
+  return (chart?.dependencies ?? []).map((d) => {
+    if (!d.name || !d.version || !d.repository || !/^(https?|oci):\/\//.test(d.repository))
+      throw new Error(`chart dependency ${JSON.stringify(d)}: needs a name, a version and an http(s) or oci repository`);
+    return { name: d.name, version: d.version, repository: d.repository };
+  });
+}
+
+/** The remote `helm pull` of a dependency into `<remoteChart>/charts`. */
+export function helmPullCommand(dep: ChartDependency, remoteChart: string): string {
+  const ref = dep.repository.startsWith("oci://") ? [`${dep.repository.replace(/\/+$/, "")}/${dep.name}`] : [dep.name, "--repo", dep.repository];
+  return ["helm", "pull", ...ref, "--version", dep.version, "--destination", `${remoteChart}/charts`].map(shq).join(" ");
+}
+
 /** One image to get onto the host before the upgrade. */
 export interface HostImage {
   repository: string;
@@ -178,6 +217,8 @@ export async function deployOverSsh(
     flags: HelmFlagOptions;
     deployments: readonly string[];
     rolloutTimeoutSeconds: number;
+    dependencies?: readonly ChartDependency[];
+    wait?: HelmWait;
   },
 ): Promise<void> {
   const ssh = await sshSession(ctx, { host: o.host, key: o.key });
@@ -196,7 +237,12 @@ export async function deployOverSsh(
   ctx.log("helm upgrade", { release: o.release, namespace: o.namespace, host: o.host });
   await ssh.run(`rm -rf ${shq(remoteChart)}`);
   await ssh.copy(o.chartDir, remoteChart);
-  await ssh.run(helmUpgradeCommand({ ...o.flags, remoteChart, release: o.release, namespace: o.namespace }));
+  if (o.dependencies?.length) await ssh.run(`mkdir -p ${shq(`${remoteChart}/charts`)}`);
+  for (const dep of o.dependencies ?? []) {
+    ctx.log("pulling chart dependency", { chart: `${dep.name}@${dep.version}`, repository: dep.repository });
+    await ssh.run(helmPullCommand(dep, remoteChart));
+  }
+  await ssh.run(helmUpgradeCommand({ ...o.flags, remoteChart, release: o.release, namespace: o.namespace, ...(o.wait ? { wait: o.wait } : {}) }));
   for (const d of o.deployments) {
     const target = d.includes("/") ? d : `deploy/${d}`;
     ctx.log("waiting for rollout", { deployment: target });
@@ -221,26 +267,26 @@ export function helmDeployOverSsh<
   const K extends string,
   const Im extends Record<string, string> = DefaultImages,
   const Rf extends Record<string, string> = {},
->(def: HelmDeploySshTargetDef<N, K, Im, Rf>): Step<N, HelmTargetDeployInput<Im, Rf>, typeof HelmRelease, K> & LibraryStep;
+>(def: HelmDeploySshTargetDef<N, K, Im, Rf>): Implementation<Step<N, HelmTargetDeployInput<Im, Rf>, typeof HelmRelease, K>>;
 export function helmDeployOverSsh<
   const N extends string,
   const K extends string,
   const Im extends Record<string, string> = DefaultImages,
   const R extends boolean = false,
   const Rf extends Record<string, string> = {},
->(def: HelmDeployOverSshDef<N, K, Im, R, Rf>): Step<N, HelmDeployOverSshInput<Im, R, Rf>, typeof HelmRelease, K> & LibraryStep;
+>(def: HelmDeployOverSshDef<N, K, Im, R, Rf>): Implementation<Step<N, HelmDeployOverSshInput<Im, R, Rf>, typeof HelmRelease, K>>;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
-export function helmDeployOverSsh(def: any): Step & LibraryStep {
+export function helmDeployOverSsh(def: any): any {
   return "target" in def ? helmDeployOverSshTarget(def) : helmDeployOverSshLiteral(def);
 }
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
-function helmDeployOverSshLiteral(def: HelmDeployOverSshDef<string, string, any, boolean, any>): Step & LibraryStep {
+function helmDeployOverSshLiteral(def: HelmDeployOverSshDef<string, string, any, boolean, any>): Implementation {
   const images: Record<string, string> = def.images ?? { image: "image" };
   const imageEntries = Object.entries(images);
   const fromRegistry = def.fromRegistry === true;
   const rolloutTimeout = def.rolloutTimeoutSeconds ?? DEFAULT_ROLLOUT_TIMEOUT_SECONDS;
-  if (imageEntries.length === 0) throw new Error(`helmDeployOverSsh '${def.name}': images must not be empty`);
+  const wait: HelmWait | undefined = def.atomic || def.helmWait ? { atomic: def.atomic === true, timeoutSeconds: rolloutTimeout } : undefined;
   if ("source" in images) throw new Error(`helmDeployOverSsh '${def.name}': 'source' can't be an image input`);
   if (def.deployments?.length === 0) throw new Error(`helmDeployOverSsh '${def.name}': deployments must not be empty`);
   const imageRefs: Record<string, string> = def.imageRefs ?? {};
@@ -256,49 +302,57 @@ function helmDeployOverSshLiteral(def: HelmDeployOverSshDef<string, string, any,
   const isDefaultImages = imageEntries.length === 1 && images.image === "image";
   const configurable = { host: def.host, release: def.release, namespace: def.namespace, values: def.values ?? [], set: def.set ?? {}, healthUrl: def.healthUrl };
 
-  return makeStep(
-    "helmDeployOverSsh",
-    { name: def.name, description: def.description, image: HELM_DEPLOY_IMAGE, input, output: HelmRelease, secrets: [def.sshKey], timeoutSeconds: def.timeoutSeconds },
-    {
-      manifestConfig: () => ({
-        host: recordConfigRefs(def.host),
-        sshKey: def.sshKey.name,
-        release: recordConfigRefs(def.release),
-        namespace: recordConfigRefs(def.namespace),
-        chart: def.chart,
-        values: recordConfigRefs(configurable.values),
-        set: recordConfigRefs(configurable.set),
-        ...(isDefaultImages ? {} : { images: { ...images } }),
-        ...(fromRegistry ? { fromRegistry: true } : {}),
-        ...(refEntries.length > 0 ? { imageRefs: { ...imageRefs } } : {}),
-        ...(def.deployments ? { deployments: [...def.deployments] } : {}),
-        ...(def.rolloutTimeoutSeconds !== undefined ? { rolloutTimeoutSeconds: def.rolloutTimeoutSeconds } : {}),
-        ...(def.healthUrl !== undefined ? { healthUrl: recordConfigRefs(def.healthUrl) } : {}),
-      }),
-      async run(input: Record<string, { repository: string; tag: string; digest: string; tar?: FileRef }> & { source: { tree: FileRef } }, ctx: Ctx) {
-        const d = resolveConfigRefs(configurable, ctx.config ?? {}) as {
-          host: string; release: string; namespace: string; values: string[]; set: Record<string, string>;
-          healthUrl?: string | ({ url: string } & Pick<HttpHealthCheckOptions, "attempts" | "delaySeconds">);
-        };
-        const chartDir = chartDirectory(await ctx.files.fetch(input.source.tree), def.chart);
-        const hostImages: HostImage[] = [];
-        const flags: HelmImageFlags[] = [];
-        for (const [key, prefix] of imageEntries) {
-          const image = input[key]!;
-          hostImages.push({ repository: image.repository, tag: image.tag, ...(fromRegistry ? {} : { tar: await ctx.files.fetch(image.tar!) }) });
-          flags.push({ prefix, repository: image.repository, tag: image.tag, pullPolicy: fromRegistry ? "IfNotPresent" : "Never" });
-        }
-        const refs: HelmImageRefFlags[] = refEntries.map(([key, prefix]) => ({ prefix, repository: input[key]!.repository, tag: input[key]!.tag, digest: input[key]!.digest }));
-        await deployOverSsh(ctx, {
-          host: d.host, key: ctx.secrets[def.sshKey.name]!, chartDir, release: d.release, namespace: d.namespace, hostImages,
-          flags: { values: d.values, set: d.set, images: flags, imageRefs: refs },
-          deployments: def.deployments ?? [d.release], rolloutTimeoutSeconds: rolloutTimeout,
-        });
-        const health = typeof d.healthUrl === "string" ? { url: d.healthUrl } : d.healthUrl;
-        if (health) await httpHealthCheck(ctx, health.url, { attempts: health.attempts, delaySeconds: health.delaySeconds });
-        return { release: d.release, namespace: d.namespace, image: `${flags[0]!.repository}:${flags[0]!.tag}` };
-      },
+  const contract = step({
+    name: def.name,
+    description: def.description,
+    kind: "helmDeployOverSsh",
+    image: HELM_DEPLOY_IMAGE,
+    input,
+    output: HelmRelease,
+    secrets: [def.sshKey],
+    timeoutSeconds: def.timeoutSeconds,
+    settings: {
+      host: def.host,
+      sshKey: def.sshKey.name,
+      release: def.release,
+      namespace: def.namespace,
+      chart: def.chart,
+      values: configurable.values,
+      set: configurable.set,
+      ...(isDefaultImages ? {} : { images: { ...images } }),
+      ...(fromRegistry ? { fromRegistry: true } : {}),
+      ...(refEntries.length > 0 ? { imageRefs: { ...imageRefs } } : {}),
+      ...(def.deployments ? { deployments: [...def.deployments] } : {}),
+      ...(def.rolloutTimeoutSeconds !== undefined ? { rolloutTimeoutSeconds: def.rolloutTimeoutSeconds } : {}),
+      ...(def.dependencies ? { dependencies: true } : {}),
+      ...(def.atomic ? { atomic: true } : def.helmWait ? { helmWait: true } : {}),
+      ...(def.healthUrl !== undefined ? { healthUrl: def.healthUrl } : {}),
     },
-    configurable,
-  ) as never;
+  });
+  return implement(contract, async (stepInput, ctx: Ctx) => {
+    const input = stepInput as unknown as Record<string, { repository: string; tag: string; digest: string; tar?: FileRef }> & { source: { tree: FileRef } };
+    const d = resolveConfigRefs(configurable, ctx.config ?? {}) as {
+      host: string; release: string; namespace: string; values: string[]; set: Record<string, string>;
+      healthUrl?: string | ({ url: string } & Pick<HttpHealthCheckOptions, "attempts" | "delaySeconds">);
+    };
+    const chartDir = chartDirectory(await ctx.files.fetch(input.source.tree), def.chart);
+    const hostImages: HostImage[] = [];
+    const flags: HelmImageFlags[] = [];
+    for (const [key, prefix] of imageEntries) {
+      const image = input[key]!;
+      hostImages.push({ repository: image.repository, tag: image.tag, ...(fromRegistry ? {} : { tar: await ctx.files.fetch(image.tar!) }) });
+      flags.push({ prefix, repository: image.repository, tag: image.tag, pullPolicy: fromRegistry ? "IfNotPresent" : "Never" });
+    }
+    const refs: HelmImageRefFlags[] = refEntries.map(([key, prefix]) => ({ prefix, repository: input[key]!.repository, tag: input[key]!.tag, digest: input[key]!.digest }));
+    await deployOverSsh(ctx, {
+      host: d.host, key: ctx.secrets[def.sshKey.name]!, chartDir, release: d.release, namespace: d.namespace, hostImages,
+      flags: { values: d.values, set: d.set, images: flags, imageRefs: refs },
+      deployments: def.deployments ?? (imageEntries.length && !wait ? [d.release] : []), rolloutTimeoutSeconds: rolloutTimeout,
+      ...(def.dependencies ? { dependencies: chartDependencies(chartDir) } : {}),
+      ...(wait ? { wait } : {}),
+    });
+    const health = typeof d.healthUrl === "string" ? { url: d.healthUrl } : d.healthUrl;
+    if (health) await httpHealthCheck(ctx, health.url, { attempts: health.attempts, delaySeconds: health.delaySeconds });
+    return { release: d.release, namespace: d.namespace, ...(flags[0] ? { image: `${flags[0].repository}:${flags[0].tag}` } : {}) };
+  }) as never;
 }

package/src/library/helm-deploy.ts

@@ -6,12 +6,13 @@ import { join } from "node:path";
 import { z } from "zod";
 import type { Ctx } from "../ctx/types.ts";
 import type { Configurable } from "../core/config.ts";
-import { recordConfigRefs, resolveConfigRefs } from "../core/config-refs.ts";
+import { resolveConfigRefs } from "../core/config-refs.ts";
+import { implement, type Implementation } from "../core/handlers.ts";
 import type { FileRef } from "../core/models.ts";
 import { optional } from "../core/models.ts";
 import type { Secret } from "../core/secrets.ts";
 import { secretRef } from "../core/config.ts";
-import { makeStep, type LibraryStep, type LiteralName, type Step, type StepKind } from "../core/steps.ts";
+import { step, type AnyStep, type LiteralName, type Step } from "../core/steps.ts";
 import type { Simplify } from "../core/types.ts";
 import { serviceUrl } from "./checks.ts";
 import { chartDirectory, deployOverSsh, DEFAULT_ROLLOUT_TIMEOUT_SECONDS, HELM_DEPLOY_IMAGE, helmFlags, type HelmImageFlags, type HelmImageRefFlags } from "./helm-deploy-ssh.ts";
@@ -117,7 +118,8 @@ export interface HelmTargetDeployDef<N extends string, Im extends Record<string,
   inlineValues?: readonly Readonly<Record<string, unknown>>[];
   /**
    * The images to deploy: step input key → the chart's values prefix. Each input is a `PushedImage`;
-   * the step sets `<prefix>.repository`, `.tag`, `.digest` and `.pullPolicy=IfNotPresent`.
+   * the step sets `<prefix>.repository`, `.tag`, `.digest` and `.pullPolicy=IfNotPresent`. `{}` deploys
+   * the chart alone.
    */
   images?: Im & { readonly source?: never };
   /**
@@ -144,7 +146,7 @@ export interface HelmDeploySshTargetDef<N extends string, K extends string, Im e
   target: Configurable<SshTargetValue>;
   /** Private key for the target's host. */
   sshKey: Secret<K>;
-  /** Rollouts to wait for (`deploy/<name>` for a bare name). Default: the release name. */
+  /** Rollouts to wait for (`deploy/<name>` for a bare name). Default: the release name, or none without images. */
   deployments?: readonly string[];
 }
 
@@ -157,12 +159,12 @@ export function helmDeployInCluster<
   const N extends string,
   const Im extends Record<string, string> = DefaultImages,
   const Rf extends Record<string, string> = {},
->(def: HelmDeployInClusterDef<N, Im, Rf>): Step<N, HelmTargetDeployInput<Im, Rf>, typeof HelmRelease, never> & LibraryStep {
+>(def: HelmDeployInClusterDef<N, Im, Rf>): Implementation<Step<N, HelmTargetDeployInput<Im, Rf>, typeof HelmRelease, never>> {
   return targetDeploy("helmDeployInCluster", def as unknown as AnyTargetDef, undefined) as never;
 }
 
 /** The `target` form of `steps.helmDeployOverSsh`: an ssh target from config, registry images by digest. */
-export function helmDeployOverSshTarget(def: HelmDeploySshTargetDef<string, string, Record<string, string>, Record<string, string>>): Step & LibraryStep {
+export function helmDeployOverSshTarget(def: HelmDeploySshTargetDef<string, string, Record<string, string>, Record<string, string>>): Implementation {
   return targetDeploy("helmDeployOverSsh", def as unknown as AnyTargetDef, def.sshKey, def.deployments) as never;
 }
 
@@ -179,13 +181,12 @@ interface AnyTargetDef {
   timeoutSeconds?: number;
 }
 
-function targetDeploy(kind: StepKind, def: AnyTargetDef, sshKey: Secret | undefined, deployments?: readonly string[]): Step & LibraryStep {
+function targetDeploy(kind: "helmDeployInCluster" | "helmDeployOverSsh", def: AnyTargetDef, sshKey: Secret | undefined, deployments?: readonly string[]): Implementation {
   const images: Record<string, string> = { ...(def.images ?? { image: "image" }) };
   const imageEntries = Object.entries(images);
   const imageRefs: Record<string, string> = { ...(def.imageRefs ?? {}) };
   const refEntries = Object.entries(imageRefs);
   const rolloutTimeout = def.rolloutTimeoutSeconds ?? DEFAULT_ROLLOUT_TIMEOUT_SECONDS;
-  if (imageEntries.length === 0) throw new Error(`${kind} '${def.name}': images must not be empty`);
   if ("source" in images || "source" in imageRefs) throw new Error(`${kind} '${def.name}': 'source' can't be an image input`);
   for (const [key] of refEntries) if (key in images) throw new Error(`${kind} '${def.name}': '${key}' is both in images and imageRefs`);
   if (deployments?.length === 0) throw new Error(`${kind} '${def.name}': deployments must not be empty`);
@@ -198,71 +199,73 @@ function targetDeploy(kind: StepKind, def: AnyTargetDef, sshKey: Secret | undefi
   };
   const configurable = { target: def.target, inlineValues: def.inlineValues ?? [] };
 
-  return makeStep(
+  const contract = step({
+    name: def.name,
+    description: def.description,
     kind,
-    {
-      name: def.name, description: def.description, image: inCluster ? HELM_IMAGE : HELM_DEPLOY_IMAGE, input, output: HelmRelease,
-      secrets: sshKey ? [sshKey] : [], timeoutSeconds: def.timeoutSeconds, ...(inCluster ? { clusterAccess: true } : {}),
+    image: inCluster ? HELM_IMAGE : HELM_DEPLOY_IMAGE,
+    input,
+    output: HelmRelease,
+    secrets: sshKey ? [sshKey] : [],
+    timeoutSeconds: def.timeoutSeconds,
+    ...(inCluster ? { clusterAccess: true } : {}),
+    settings: {
+      target: def.target,
+      ...(sshKey ? { sshKey: sshKey.name } : {}),
+      chart: def.chart,
+      ...(def.inlineValues?.length ? { inlineValues: def.inlineValues } : {}),
+      images: { ...images },
+      ...(refEntries.length > 0 ? { imageRefs: { ...imageRefs } } : {}),
+      ...(deployments ? { deployments: [...deployments] } : {}),
+      ...(def.rolloutTimeoutSeconds !== undefined ? { rolloutTimeoutSeconds: def.rolloutTimeoutSeconds } : {}),
+      ...(def.healthPath !== undefined ? { healthPath: def.healthPath } : {}),
     },
-    {
-      manifestConfig: () => ({
-        target: recordConfigRefs(def.target),
-        ...(sshKey ? { sshKey: sshKey.name } : {}),
-        chart: def.chart,
-        ...(def.inlineValues?.length ? { inlineValues: recordConfigRefs(def.inlineValues) } : {}),
-        images: { ...images },
-        ...(refEntries.length > 0 ? { imageRefs: { ...imageRefs } } : {}),
-        ...(deployments ? { deployments: [...deployments] } : {}),
-        ...(def.rolloutTimeoutSeconds !== undefined ? { rolloutTimeoutSeconds: def.rolloutTimeoutSeconds } : {}),
-        ...(def.healthPath !== undefined ? { healthPath: def.healthPath } : {}),
-      }),
-      async run(input: Record<string, { repository: string; tag: string; digest: string } | undefined> & { source: { tree: FileRef } }, ctx: Ctx) {
-        const { target, inlineValues } = resolveConfigRefs(configurable, ctx.config ?? {}) as { target: HelmTargetValue; inlineValues: Record<string, unknown>[] };
-        const want = inCluster ? "inCluster" : "ssh";
-        if (target?.kind !== want) throw new Error(`${kind} '${def.name}': the target is kind '${String(target?.kind)}', not '${want}'`);
-        const chartDir = chartDirectory(await ctx.files.fetch(input.source.tree), def.chart);
+  } as never) as AnyStep;
+  return implement(contract, async (stepInput, ctx: Ctx) => {
+    const input = stepInput as unknown as Record<string, { repository: string; tag: string; digest: string } | undefined> & { source: { tree: FileRef } };
+    const { target, inlineValues } = resolveConfigRefs(configurable, ctx.config ?? {}) as { target: HelmTargetValue; inlineValues: Record<string, unknown>[] };
+    const want = inCluster ? "inCluster" : "ssh";
+    if (target?.kind !== want) throw new Error(`${kind} '${def.name}': the target is kind '${String(target?.kind)}', not '${want}'`);
+    const chartDir = chartDirectory(await ctx.files.fetch(input.source.tree), def.chart);
 
-        const generated = inlineValues.map((values, i) => {
-          const file = `olve-values-${i}.json`;
-          writeFileSync(join(chartDir, file), JSON.stringify(values));
-          return file;
-        });
-        const flags: HelmImageFlags[] = imageEntries.map(([key, prefix]) => {
-          const image = input[key]!;
-          return { prefix, repository: image.repository, tag: image.tag, digest: image.digest, pullPolicy: "IfNotPresent" };
-        });
-        const refs: HelmImageRefFlags[] = refEntries.flatMap(([key, prefix]) => {
-          const image = input[key];
-          return image ? [{ prefix, repository: image.repository, tag: image.tag, digest: image.digest }] : [];
-        });
-        const helm = { values: [...target.values, ...generated], set: target.set, images: flags, imageRefs: refs };
-        const { release, namespace } = target;
+    const generated = inlineValues.map((values, i) => {
+      const file = `olve-values-${i}.json`;
+      writeFileSync(join(chartDir, file), JSON.stringify(values));
+      return file;
+    });
+    const flags: HelmImageFlags[] = imageEntries.map(([key, prefix]) => {
+      const image = input[key]!;
+      return { prefix, repository: image.repository, tag: image.tag, digest: image.digest, pullPolicy: "IfNotPresent" };
+    });
+    const refs: HelmImageRefFlags[] = refEntries.flatMap(([key, prefix]) => {
+      const image = input[key];
+      return image ? [{ prefix, repository: image.repository, tag: image.tag, digest: image.digest }] : [];
+    });
+    const helm = { values: [...target.values, ...generated], set: target.set, images: flags, imageRefs: refs };
+    const { release, namespace } = target;
 
-        if (target.kind === "ssh") {
-          const key = ctx.secrets[sshKey!.name];
-          if (!key) throw new Error(`secret ${sshKey!.name} (sshKey) is not set`);
-          await deployOverSsh(ctx, {
-            host: target.host, key, chartDir, release, namespace,
-            hostImages: flags.map((f) => ({ repository: f.repository, tag: f.tag, digest: f.digest })),
-            flags: helm, deployments: deployments ?? [release], rolloutTimeoutSeconds: rolloutTimeout,
-          });
-        } else {
-          if (!existsSync(SERVICE_ACCOUNT_TOKEN))
-            throw new Error(`no ServiceAccount token in the step pod: the instance grants no step ServiceAccount (Kubernetes:StepServiceAccount), so an inCluster target can't be deployed`);
-          const home = join(ctx.tmpDir, "helm-home");
-          ctx.log("helm upgrade", { release, namespace, images: flags.map((f) => `${f.repository}@${f.digest}`).join(" ") });
-          await ctx.exec(["helm", "upgrade", "--install", release, ".", "-n", namespace, ...helmFlags(helm), "--wait", `--timeout=${rolloutTimeout}s`], {
-            cwd: chartDir,
-            env: { HOME: home, HELM_CACHE_HOME: join(home, "cache"), HELM_CONFIG_HOME: join(home, "config"), HELM_DATA_HOME: join(home, "data") },
-          });
-        }
+    if (target.kind === "ssh") {
+      const key = ctx.secrets[sshKey!.name];
+      if (!key) throw new Error(`secret ${sshKey!.name} (sshKey) is not set`);
+      await deployOverSsh(ctx, {
+        host: target.host, key, chartDir, release, namespace,
+        hostImages: flags.map((f) => ({ repository: f.repository, tag: f.tag, digest: f.digest })),
+        flags: helm, deployments: deployments ?? (imageEntries.length ? [release] : []), rolloutTimeoutSeconds: rolloutTimeout,
+      });
+    } else {
+      if (!existsSync(SERVICE_ACCOUNT_TOKEN))
+        throw new Error(`no ServiceAccount token in the step pod: the instance grants no step ServiceAccount (Kubernetes:StepServiceAccount), so an inCluster target can't be deployed`);
+      const home = join(ctx.tmpDir, "helm-home");
+      ctx.log("helm upgrade", { release, namespace, images: flags.map((f) => `${f.repository}@${f.digest}`).join(" ") });
+      await ctx.exec(["helm", "upgrade", "--install", release, ".", "-n", namespace, ...helmFlags(helm), "--wait", `--timeout=${rolloutTimeout}s`], {
+        cwd: chartDir,
+        env: { HOME: home, HELM_CACHE_HOME: join(home, "cache"), HELM_CONFIG_HOME: join(home, "config"), HELM_DATA_HOME: join(home, "data") },
+      });
+    }
 
-        const url = (target.url ?? serviceUrl({ release, namespace })).replace(/\/+$/, "");
-        if (def.healthPath !== undefined) await httpHealthCheck(ctx, `${url}${def.healthPath}`, { attempts: 12, delaySeconds: 5 });
-        const main = flags[0]!;
-        return { release, namespace, image: `${main.repository}:${main.tag}@${main.digest}`, ...(target.url ? { url } : {}) };
-      },
-    },
-    configurable,
-  ) as never;
+    const url = (target.url ?? serviceUrl({ release, namespace })).replace(/\/+$/, "");
+    if (def.healthPath !== undefined) await httpHealthCheck(ctx, `${url}${def.healthPath}`, { attempts: 12, delaySeconds: 5 });
+    const main = flags[0];
+    return { release, namespace, ...(main ? { image: `${main.repository}:${main.tag}@${main.digest}` } : {}), ...(target.url ? { url } : {}) } as never;
+  }) as never;
 }