Azure / Azure/setup-helm

Bug: azure/setup-helm@v4 Automatically Installing Helm v4.0.1 Causing Plugin Verification Failure

Open
#239 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
191
Forks
79
Avg merge
17d 9h
Merged PRs (30d)
1

Description

### What happened?

## Summary
Starting 25th November 2025, our GitHub Actions workflow began failing during Helm plugin installation. This happened because `azure/setup-helm@v4` started installing Helm v4.0.1 instead of Helm 3.x versions that it consistently installed earlier. Helm v4 introduces mandatory plugin verification, which is not supported by several plugins including `hypnoglow/helm-s3`.

As a result, previously stable workflows started failing without any changes from our side.

## Error Observed
``` yaml
Error: plugin source does not support verification. Use --verify=false to skip verification
```
This error occurs during the installation of the `helm-s3` plugin when Helm v4.0.1 is used.

## Expected Behavior
- The action should not silently upgrade major Helm versions.
- Helm v3 should continue to be installed unless explicitly configured otherwise.
- Major-breaking changes like Helm v4 should require explicit opt-in from the user.
- Documentation should clearly call out the impact of major version upgrades.

## Actual Behavior
- `azure/setup-helm@v4` automatically installs Helm v4.0.1.
- Helm v4 enforces plugin verification.
- Plugins that do not support verification (e.g., `helm-s3`) fail during installation.
- This caused previously working Helm workflows to break unexpectedly.

## Impact
- Our workflow, unchanged for over a year, began failing suddenly.
- Using `--verify=false` is not acceptable due to internal security practices.
- This created avoidable operational disruption.

## Actions Taken / Workaround

We replaced `azure/setup-helm@v4` with a manual Helm installation script to ensure Helm v3 is used:
### Earlier
```yaml
- name: Install Helm
uses: azure/setup-helm@v4
```
### Current Step (workaround using Helm v3)
```yaml
- name: Install Helm
run: |
curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
chmod 700 get_helm.sh
./get_helm.sh
echo "Installed Helm Version: $(helm version --template='{{.Version}}')"
```

This workaround installs Helm v3, and plugin installation works successfully.

## Request
We kindly request the following:
1. Clarify whether switching to Helm v4 by default is intentional behavior for azure/setup-helm@v4.
2. Provide a mechanism to pin Helm major versions directly through the action.
3. Avoid major version upgrades without explicit user opt-in.
4. Update documentation to highlight breaking changes when Helm v4 is installed.

This will help avoid unexpected failures for users relying on Helm plugins that are not yet compatible with v4.

### Version

- [x] I am using the latest version

### Runner

self-hosted and runner version: 2.329.0

### Relevant log output

```yaml
helm plugin install https://github.com/hypnoglow/helm-s3.git
Error: plugin source does not support verification. Use --verify=false to skip verification
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.