[vigneshrajsb]

Summary

Follow-up to the buildkit build-job quoting fix. The native Helm deploy job and the git clone init containers had the same class of bug: user-controlled strings were interpolated into sh -c scripts, so values with shell metacharacters broke the job or ran as shell code (for example $(cmd) in a service env value was executed, and an unbalanced quote caused a shell syntax error). Kubernetes additionally expands $(VAR) and collapses $$ in container args and env values, which silently altered values containing $.

Changes

• Helm deploy script: every --set / --set-file value is single-quoted; chart, release, namespace, version, repo and values-file tokens use quote-if-needed; the executed command is logged with printf instead of an echo in double quotes.
• Git clone scripts: branch, revision, sha and target dir are quoted.
• Every user-controlled $ is doubled for Kubernetes in the build script, kaniko args, container env values, helm deploy script and clone scripts, so the container receives the original text.
• Shared shellQuote module (shellQuote, quoteIfNeeded, escapeK8sDollar); engines.ts still re-exports shellQuote.

Behavior changes

• --set values keep the two effects the old double-quoted shell evaluation had and configs rely on: a value wrapped in double quotes loses them (k="x", k="", and the quotes the env serializer adds), and \\, \", \$, ``` lose their backslash. No expansion happens.
• Bare commas in quoted values are escaped as \, so Helm accepts them (Helm rejects a=b,c with key "c" has no value).
• Values containing spaces now reach Helm as one argument instead of being split by the shell.
• Values containing $$ or $(NAME) are now passed literally instead of being expanded by Kubernetes.

Not changed

Raw args/defaultArgs helm flags and webhook command scripts remain intentional shell text. escapeHelmValue still does not escape a literal backslash (Helm-layer behavior).

Validation

• pnpm test:coverage (Node 22), pnpm lint, pnpm build pass.
• A differential test runs real-world value shapes through the old shell evaluation and the new code and requires identical Helm arguments.
• New tests run the whole generated Helm script and the clone scripts under a stub helm/git in a real sh, after simulating Kubernetes $$ / $(VAR) expansion, and assert each hostile value arrives as one literal argument with nothing executed. Reverting the quoting or the $ escaping makes them fail.