[aegis-cipherowl]

INF-2315

Problem

helm_deployment(post_renderers=[...]) never runs on deploy. prepare_post_renderer_for_helm_deployment built SetupHelmPostRenderer without extra_post_renderers, so only the built-in image-ref post-renderer ran, and the chaining code in subsystems/post_renderer.py was never reached.

Change

• Pass field_set.post_renderers.to_unparsed_address_inputs() as extra_post_renderers when the field is set.
• New rule test test_deployment_post_renderers_are_chained_after_builtin. Its chained script rewrites app:latest, which is the ref the built-in renderer writes, to app:chained. So the test passes only if both renderers run, in that order. Without the fix it fails, and the output still shows app:latest.
• Fixed the fixture in test_use_simple_extra_post_renderer. That test only passed because its renderer never ran. Its run_shell_command used a build-root-relative command with the default workdir (the BUILD dir). Once wired up, it failed with No such file or directory. It now sets workdir="/".
• VERSION → 2.33.0+cipherowl.8.

Testing

• pants test src/python/pants/backend/helm::: all 26 targets pass. Five targets hit the 60s default timeout under local parallel load and pass when rerun alone with a longer timeout.
• pants fmt lint check on the touched files: clean.

Note for consumers

run_shell_command post-renderers run with workdir defaulting to the BUILD file's directory. So a renderer whose command is a build-root-relative path needs workdir="/".

🤖 Generated with Claude Code