version 0.105.1 fixes oci chart auth (#447 )

Merge pull request #447 from manrueda/feat-oci-chart-authentication
Allows authentication of OCI charts
2026-03-21 01:35:02 +00:00 · 2025-09-25 07:12:41 -07:00 · 2025-09-25 07:08:13 -07:00 · 2025-09-25 09:52:38 -04:00 · 2025-09-24 20:58:09 -07:00 · 2025-09-24 20:46:49 -07:00
50 changed files with 384 additions and 121 deletions
--- a/15
+++ b/15
@@ -1,6 +1,6 @@
-FROM registry.k8s.io/kubectl:v1.31.0 AS kubectl
+FROM registry.k8s.io/kubectl:v1.33.4 AS kubectl
 # https://github.com/GoogleContainerTools/distroless
-FROM golang:1.23 AS build
+FROM golang:1.24 AS build

 WORKDIR /go/src/app
 COPY . .
@@ -18,8 +18,8 @@ RUN curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/s

 COPY --from=kubectl /bin/kubectl /usr/local/bin/

-# distroless
-FROM gcr.io/distroless/static-debian12 AS final
+# Use debian slim instead of distroless to get package management.
+FROM public.ecr.aws/docker/library/debian:13-slim AS final
 COPY --from=build \
     /go/bin/holos \
     /go/bin/kustomize \
@@ -27,5 +27,12 @@ COPY --from=build \
     /usr/local/bin/helm \
     /bin/

+# Extra packages
+# git - https://github.com/holos-run/holos/issues/440
+RUN apt update && \
+    apt install -y --no-install-recommends git ca-certificates && \
+    apt clean && \
+    rm -rf /var/lib/apt/lists/*
+
 # Usage: docker run -v $(pwd):/app --workdir /app --rm -it quay.io/holos-run/holos holos render platform
 CMD ["/bin/holos"]
--- a/1
+++ b/1
@@ -136,6 +136,7 @@ unity: ## https://cuelabs.dev/unity/
 .PHONY: update-docs
 update-docs: ## Update doc examples
 	HOLOS_UPDATE_SCRIPTS=1 go test -v ./doc/md/...
+	HOLOS_UPDATE_SCRIPTS=1 go test -v ./doc/website/versioned_docs/...

 .PHONY: help
 help:  ## Display this help menu.
--- a/api/core/v1alpha6/types.go
+++ b/api/core/v1alpha6/types.go
@@ -274,8 +274,8 @@ type Chart struct {
 // repository.  Holos gets the username and password from the environment
 // variables represented by the Auth field.
 type Repository struct {
-	Name string `json:"name" yaml:"name"`
-	URL  string `json:"url" yaml:"url"`
+	Name string `json:"name,omitempty" yaml:"name,omitempty"`
+	URL  string `json:"url,omitempty" yaml:"url,omitempty"`
 	Auth Auth   `json:"auth,omitempty" yaml:"auth,omitempty"`
 }

--- a/doc/md/tutorial/_hello-holos/examples/01-holos-version.txt
+++ b/doc/md/tutorial/_hello-holos/examples/01-holos-version.txt
@@ -4,4 +4,4 @@ cmp stdout $WORK/output.txt
 -- command.sh --
 holos --version
 -- output.txt --
-0.104.1
+0.105.1
--- a/doc/md/tutorial/_hello-holos/script-01-holos-version/output.txt
+++ b/doc/md/tutorial/_hello-holos/script-01-holos-version/output.txt
@@ -1 +1 @@
-0.104.1
+0.105.0
--- a/doc/md/tutorial/_hello-holos/script-02-hello-holos/register-components-output.txt
+++ b/doc/md/tutorial/_hello-holos/script-02-hello-holos/register-components-output.txt
@@ -1,3 +1,2 @@
-cached podinfo 6.6.2
-rendered podinfo in 1.938665041s
-rendered platform in 1.938759417s
+rendered podinfo in 192.932708ms
+rendered platform in 193.051959ms
--- a/doc/md/tutorial/_hello-holos/script-02-hello-holos/tree.txt
+++ b/doc/md/tutorial/_hello-holos/script-02-hello-holos/tree.txt
@@ -9,9 +9,8 @@
 |-- platform
 |   |-- platform.gen.cue
 |   `-- podinfo.cue
-|-- platform.metadata.json
 |-- resources.cue
 |-- schema.cue
 `-- tags.cue

-8 directories, 7 files
+8 directories, 6 files
--- a/doc/md/tutorial/_helm-values/examples/01-holos-version.txt
+++ b/doc/md/tutorial/_helm-values/examples/01-holos-version.txt
@@ -4,4 +4,4 @@ cmp stdout $WORK/output.txt
 -- command.sh --
 holos --version
 -- output.txt --
-0.104.1
+0.105.1
--- a/doc/md/tutorial/_helm-values/script-01-holos-version/output.txt
+++ b/doc/md/tutorial/_helm-values/script-01-holos-version/output.txt
@@ -1 +1 @@
-0.104.1
+0.105.0
--- a/doc/md/tutorial/_helm-values/script-02-helm-values/blackbox-common-config-git-output.txt
+++ b/doc/md/tutorial/_helm-values/script-02-helm-values/blackbox-common-config-git-output.txt
@@ -1,3 +1,3 @@
-[main 1adcd08] add blackbox configuration
+[main 535726f] add blackbox configuration
 1 file changed, 15 insertions(+)
- create mode 100644 components/blackbox.cue
+ create mode 100644 config/prometheus/blackbox.cue
--- a/doc/md/tutorial/_helm-values/script-02-helm-values/common-config-git-output.txt
+++ b/doc/md/tutorial/_helm-values/script-02-helm-values/common-config-git-output.txt
@@ -1,2 +1,3 @@
-[main 4221803] integrate blackbox and prometheus together
- 2 files changed, 4 insertions(+), 2 deletions(-)
+[main 797f2d6] integrate blackbox and prometheus together
+ 3 files changed, 1348 insertions(+), 2 deletions(-)
+ create mode 100644 components/prometheus/values.cue.orig
--- a/doc/md/tutorial/_helm-values/script-02-helm-values/import-values-git-output.txt
+++ b/doc/md/tutorial/_helm-values/script-02-helm-values/import-values-git-output.txt
@@ -1,4 +1,4 @@
-[main 52e90ea] import values
+[main 69f44c9] import values
 2 files changed, 1815 insertions(+)
 create mode 100644 components/blackbox/values.cue
 create mode 100644 components/prometheus/values.cue
--- a/doc/md/tutorial/_helm-values/script-02-helm-values/import-values-render-output.txt
+++ b/doc/md/tutorial/_helm-values/script-02-helm-values/import-values-render-output.txt
@@ -1,3 +1,3 @@
-rendered blackbox in 365.936792ms
-rendered prometheus in 371.855875ms
-rendered platform in 372.109916ms
+rendered blackbox in 114.666583ms
+rendered prometheus in 148.566542ms
+rendered platform in 148.701ms
--- a/doc/md/tutorial/_helm-values/script-02-helm-values/register-components-git-commit-output.txt
+++ b/doc/md/tutorial/_helm-values/script-02-helm-values/register-components-git-commit-output.txt
@@ -1,4 +1,4 @@
-[main b5df111] add blackbox and prometheus
+[main a6310d2] add blackbox and prometheus
 5 files changed, 1550 insertions(+)
 create mode 100644 components/blackbox/blackbox.cue
 create mode 100644 components/prometheus/prometheus.cue
--- a/doc/md/tutorial/_helm-values/script-02-helm-values/register-components-output.txt
+++ b/doc/md/tutorial/_helm-values/script-02-helm-values/register-components-output.txt
@@ -1,5 +1,3 @@
-cached prometheus-blackbox-exporter 9.0.1
-rendered blackbox in 3.825430417s
-cached prometheus 25.27.0
-rendered prometheus in 4.840089667s
-rendered platform in 4.840137792s
+rendered blackbox in 763.438542ms
+rendered prometheus in 903.55375ms
+rendered platform in 903.625583ms
--- a/doc/md/tutorial/_helm-values/script-02-helm-values/reviewing-changes-git-output.txt
+++ b/doc/md/tutorial/_helm-values/script-02-helm-values/reviewing-changes-git-output.txt
@@ -1,2 +1,2 @@
-[main 67efe0d] render integrated blackbox and prometheus manifests
+[main 6d7e29b] render integrated blackbox and prometheus manifests
 2 files changed, 7 insertions(+), 7 deletions(-)
--- a/doc/md/tutorial/_kustomize/examples/01-holos-version.txt
+++ b/doc/md/tutorial/_kustomize/examples/01-holos-version.txt
@@ -4,4 +4,4 @@ cmp stdout $WORK/output.txt
 -- command.sh --
 holos --version
 -- output.txt --
-0.104.1
+0.105.1
--- a/doc/md/tutorial/_kustomize/script-01-holos-version/output.txt
+++ b/doc/md/tutorial/_kustomize/script-01-holos-version/output.txt
@@ -1 +1 @@
-0.104.1
+0.105.0
--- a/doc/md/tutorial/_kustomize/script-02-kustomize/buildplan-output.cue
+++ b/doc/md/tutorial/_kustomize/script-02-kustomize/buildplan-output.cue
@@ -27,9 +27,9 @@ spec:
                - includeSelectors: false
                  pairs:
                    app.kubernetes.io/name: httpbin
-              patches: []
              images:
                - name: mccutchen/go-httpbin
+              patches: []
              resources:
                - resources.gen.yaml
                - httpbin.yaml
--- a/doc/md/tutorial/_kustomize/script-02-kustomize/git-commit-component-output.txt
+++ b/doc/md/tutorial/_kustomize/script-02-kustomize/git-commit-component-output.txt
@@ -1,4 +1,4 @@
-[main 823e136] add httpbin
+[main 185fc76] add httpbin
 4 files changed, 113 insertions(+)
 create mode 100644 components/httpbin/httpbin.cue
 create mode 100644 components/httpbin/httpbin.yaml
--- a/doc/md/tutorial/_kustomize/script-02-kustomize/git-commit-final-output.txt
+++ b/doc/md/tutorial/_kustomize/script-02-kustomize/git-commit-final-output.txt
@@ -1,3 +1,3 @@
-[main 96f5f45] annotate httpbin for prometheus probes
+[main da34784] annotate httpbin for prometheus probes
 2 files changed, 18 insertions(+)
 create mode 100644 components/httpbin/patches.cue
--- a/doc/md/tutorial/_kustomize/script-02-kustomize/kustomize-patch-render-output.txt
+++ b/doc/md/tutorial/_kustomize/script-02-kustomize/kustomize-patch-render-output.txt
@@ -1,2 +1,2 @@
-rendered httpbin in 112.916375ms
-rendered platform in 112.990333ms
+rendered httpbin in 80.450916ms
+rendered platform in 80.532083ms
--- a/doc/md/tutorial/_kustomize/script-02-kustomize/register-component-output.txt
+++ b/doc/md/tutorial/_kustomize/script-02-kustomize/register-component-output.txt
@@ -1,2 +1,2 @@
-rendered httpbin in 111.183042ms
-rendered platform in 111.265792ms
+rendered httpbin in 80.982541ms
+rendered platform in 81.059042ms
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_hello-holos/examples/01-holos-version.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_hello-holos/examples/01-holos-version.txt
@@ -4,4 +4,4 @@ cmp stdout $WORK/output.txt
 -- command.sh --
 holos --version
 -- output.txt --
-0.104.1
+0.105.1
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_hello-holos/script-01-holos-version/output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_hello-holos/script-01-holos-version/output.txt
@@ -1 +1 @@
-0.104.1
+0.105.0
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_hello-holos/script-02-hello-holos/register-components-output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_hello-holos/script-02-hello-holos/register-components-output.txt
@@ -1,3 +1,2 @@
-cached podinfo 6.6.2
-rendered podinfo in 1.938665041s
-rendered platform in 1.938759417s
+rendered podinfo in 173.452208ms
+rendered platform in 173.536625ms
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_hello-holos/script-02-hello-holos/tree.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_hello-holos/script-02-hello-holos/tree.txt
@@ -9,9 +9,8 @@
 |-- platform
 |   |-- platform.gen.cue
 |   `-- podinfo.cue
-|-- platform.metadata.json
 |-- resources.cue
 |-- schema.cue
 `-- tags.cue

-8 directories, 7 files
+8 directories, 6 files
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/examples/01-holos-version.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/examples/01-holos-version.txt
@@ -4,4 +4,4 @@ cmp stdout $WORK/output.txt
 -- command.sh --
 holos --version
 -- output.txt --
-0.104.1
+0.105.1
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-01-holos-version/output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-01-holos-version/output.txt
@@ -1 +1 @@
-0.104.1
+0.105.0
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/blackbox-common-config-git-output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/blackbox-common-config-git-output.txt
@@ -1,3 +1,3 @@
-[main 1adcd08] add blackbox configuration
+[main c7f13ba] add blackbox configuration
 1 file changed, 15 insertions(+)
- create mode 100644 components/blackbox.cue
+ create mode 100644 config/prometheus/blackbox.cue
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/common-config-git-output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/common-config-git-output.txt
@@ -1,2 +1,3 @@
-[main 4221803] integrate blackbox and prometheus together
- 2 files changed, 4 insertions(+), 2 deletions(-)
+[main 0c0f974] integrate blackbox and prometheus together
+ 3 files changed, 1348 insertions(+), 2 deletions(-)
+ create mode 100644 components/prometheus/values.cue.orig
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/import-values-git-output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/import-values-git-output.txt
@@ -1,4 +1,4 @@
-[main 52e90ea] import values
+[main 941c7eb] import values
 2 files changed, 1815 insertions(+)
 create mode 100644 components/blackbox/values.cue
 create mode 100644 components/prometheus/values.cue
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/import-values-render-output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/import-values-render-output.txt
@@ -1,3 +1,3 @@
-rendered blackbox in 365.936792ms
-rendered prometheus in 371.855875ms
-rendered platform in 372.109916ms
+rendered blackbox in 113.91075ms
+rendered prometheus in 147.542125ms
+rendered platform in 147.604125ms
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/register-components-git-commit-output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/register-components-git-commit-output.txt
@@ -1,4 +1,4 @@
-[main b5df111] add blackbox and prometheus
+[main c5cfce0] add blackbox and prometheus
 5 files changed, 1550 insertions(+)
 create mode 100644 components/blackbox/blackbox.cue
 create mode 100644 components/prometheus/prometheus.cue
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/register-components-output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/register-components-output.txt
@@ -1,5 +1,3 @@
-cached prometheus-blackbox-exporter 9.0.1
-rendered blackbox in 3.825430417s
-cached prometheus 25.27.0
-rendered prometheus in 4.840089667s
-rendered platform in 4.840137792s
+rendered blackbox in 745.5255ms
+rendered prometheus in 851.327458ms
+rendered platform in 851.384291ms
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/reviewing-changes-git-output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_helm-values/script-02-helm-values/reviewing-changes-git-output.txt
@@ -1,2 +1,2 @@
-[main 67efe0d] render integrated blackbox and prometheus manifests
+[main c043d3d] render integrated blackbox and prometheus manifests
 2 files changed, 7 insertions(+), 7 deletions(-)
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/examples/01-holos-version.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/examples/01-holos-version.txt
@@ -4,4 +4,4 @@ cmp stdout $WORK/output.txt
 -- command.sh --
 holos --version
 -- output.txt --
-0.104.1
+0.105.1
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/script-01-holos-version/output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/script-01-holos-version/output.txt
@@ -1 +1 @@
-0.104.1
+0.105.0
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/script-02-kustomize/buildplan-output.cue
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/script-02-kustomize/buildplan-output.cue
@@ -27,9 +27,9 @@ spec:
                - includeSelectors: false
                  pairs:
                    app.kubernetes.io/name: httpbin
-              patches: []
              images:
                - name: mccutchen/go-httpbin
+              patches: []
              resources:
                - resources.gen.yaml
                - httpbin.yaml
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/script-02-kustomize/git-commit-component-output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/script-02-kustomize/git-commit-component-output.txt
@@ -1,4 +1,4 @@
-[main 823e136] add httpbin
+[main 860fc67] add httpbin
 4 files changed, 113 insertions(+)
 create mode 100644 components/httpbin/httpbin.cue
 create mode 100644 components/httpbin/httpbin.yaml
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/script-02-kustomize/git-commit-final-output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/script-02-kustomize/git-commit-final-output.txt
@@ -1,3 +1,3 @@
-[main 96f5f45] annotate httpbin for prometheus probes
+[main 9c6598a] annotate httpbin for prometheus probes
 2 files changed, 18 insertions(+)
 create mode 100644 components/httpbin/patches.cue
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/script-02-kustomize/kustomize-patch-render-output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/script-02-kustomize/kustomize-patch-render-output.txt
@@ -1,2 +1,2 @@
-rendered httpbin in 112.916375ms
-rendered platform in 112.990333ms
+rendered httpbin in 79.295541ms
+rendered platform in 79.3905ms
--- a/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/script-02-kustomize/register-component-output.txt
+++ b/doc/website/versioned_docs/version-v1alpha5/tutorial/_kustomize/script-02-kustomize/register-component-output.txt
@@ -1,2 +1,2 @@
-rendered httpbin in 111.183042ms
-rendered platform in 111.265792ms
+rendered httpbin in 77.872917ms
+rendered platform in 77.964167ms
--- a/go.mod
+++ b/go.mod
@@ -1,11 +1,9 @@
 module github.com/holos-run/holos

-go 1.23.0
-
-toolchain go1.23.6
+go 1.24.0

 require (
-	cuelang.org/go v0.13.0-rc.1
+	cuelang.org/go v0.14.1
 	github.com/google/go-cmp v0.7.0
 	github.com/mattn/go-isatty v0.0.20
 	github.com/mattn/go-runewidth v0.0.15
@@ -13,17 +11,17 @@ require (
 	github.com/princjef/gomarkdoc v1.1.0
 	github.com/rogpeppe/go-internal v1.14.1
 	github.com/spf13/cobra v1.9.1
-	github.com/spf13/pflag v1.0.6
+	github.com/spf13/pflag v1.0.7
 	github.com/stretchr/testify v1.10.0
-	golang.org/x/sync v0.13.0
-	golang.org/x/tools v0.32.0
+	golang.org/x/sync v0.16.0
+	golang.org/x/tools v0.35.0
 	gopkg.in/yaml.v3 v3.0.1
 	helm.sh/helm/v3 v3.16.3
 	sigs.k8s.io/kustomize/kustomize/v5 v5.5.0
 )

 require (
-	cuelabs.dev/go/oci/ociregistry v0.0.0-20250304105642-27e071d2c9b1 // indirect
+	cuelabs.dev/go/oci/ociregistry v0.0.0-20250715075730-49cab49c8e9d // indirect
 	dario.cat/mergo v1.0.1 // indirect
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
@@ -58,7 +56,7 @@ require (
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
-	github.com/emicklei/proto v1.14.0 // indirect
+	github.com/emicklei/proto v1.14.2 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/evanphx/json-patch v5.9.0+incompatible // indirect
 	github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d // indirect
@@ -110,6 +108,7 @@ require (
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mb0/glob v0.0.0-20160210091149-1eb79d2de6c4 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/miekg/dns v1.1.58 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
@@ -129,6 +128,7 @@ require (
 	github.com/onsi/ginkgo v1.16.4 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/patrickdappollonio/kubectl-slice v1.4.2 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
@@ -140,7 +140,7 @@ require (
 	github.com/prometheus/client_model v0.6.1 // indirect
 	github.com/prometheus/common v0.55.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/protocolbuffers/txtpbfmt v0.0.0-20250129171521-feedd8250727 // indirect
+	github.com/protocolbuffers/txtpbfmt v0.0.0-20250627152318-f293424e46b5 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rubenv/sql-migrate v1.7.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
@@ -153,9 +153,9 @@ require (
 	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/spf13/afero v1.11.0 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
-	github.com/spf13/viper v1.18.2 // indirect
+	github.com/spf13/viper v1.19.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/tetratelabs/wazero v1.6.0 // indirect
+	github.com/tetratelabs/wazero v1.9.0 // indirect
 	github.com/x-cray/logrus-prefixed-formatter v0.5.2 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
@@ -168,14 +168,14 @@ require (
 	go.opentelemetry.io/otel/metric v1.28.0 // indirect
 	go.opentelemetry.io/otel/trace v1.28.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.37.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
-	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/net v0.39.0 // indirect
-	golang.org/x/oauth2 v0.29.0 // indirect
-	golang.org/x/sys v0.32.0 // indirect
-	golang.org/x/term v0.31.0 // indirect
-	golang.org/x/text v0.24.0 // indirect
+	golang.org/x/mod v0.26.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/term v0.33.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
 	google.golang.org/grpc v1.65.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,7 @@
-cuelabs.dev/go/oci/ociregistry v0.0.0-20250304105642-27e071d2c9b1 h1:Dmbd5Q+ENb2C6carvwrMsrOUwJ9X9qfL5JdW32gYAHo=
-cuelabs.dev/go/oci/ociregistry v0.0.0-20250304105642-27e071d2c9b1/go.mod h1:dqrnoZx62xbOZr11giMPrWbhlaV8euHwciXZEy3baT8=
-cuelang.org/go v0.13.0-rc.1 h1:0y3LZKA5LpJehVMHTJhjR7jQxBdYZ5fg05htMaKHaJg=
-cuelang.org/go v0.13.0-rc.1/go.mod h1:kA/8D9/d32IBp2lISWo90BEJhLyS9tqBcvqw2QAEhEg=
+cuelabs.dev/go/oci/ociregistry v0.0.0-20250715075730-49cab49c8e9d h1:lX0EawyoAu4kgMJJfy7MmNkIHioBcdBGFRSKDZ+CWo0=
+cuelabs.dev/go/oci/ociregistry v0.0.0-20250715075730-49cab49c8e9d/go.mod h1:4WWeZNxUO1vRoZWAHIG0KZOd6dA25ypyWuwD3ti0Tdc=
+cuelang.org/go v0.14.1 h1:kxFAHr7bvrCikbtVps2chPIARazVdnRmlz65dAzKyWg=
+cuelang.org/go v0.14.1/go.mod h1:aSP9UZUM5m2izHAHUvqtq0wTlWn5oLjuv2iBMQZBLLs=
 dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
 dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
@@ -115,8 +115,8 @@ github.com/elazarl/goproxy v1.2.1 h1:njjgvO6cRG9rIqN2ebkqy6cQz2Njkx7Fsfv/zIZqgug
 github.com/elazarl/goproxy v1.2.1/go.mod h1:YfEbZtqP4AetfO6d40vWchF3znWX7C7Vd6ZMfdL8z64=
 github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
 github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/emicklei/proto v1.14.0 h1:WYxC0OrBuuC+FUCTZvb8+fzEHdZMwLEF+OnVfZA3LXU=
-github.com/emicklei/proto v1.14.0/go.mod h1:rn1FgRS/FANiZdD2djyH7TMA9jdRDcYQ9IEN9yvjX0A=
+github.com/emicklei/proto v1.14.2 h1:wJPxPy2Xifja9cEMrcA/g08art5+7CGJNFNk35iXC1I=
+github.com/emicklei/proto v1.14.2/go.mod h1:rn1FgRS/FANiZdD2djyH7TMA9jdRDcYQ9IEN9yvjX0A=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
@@ -308,6 +308,8 @@ github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh
 github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mb0/glob v0.0.0-20160210091149-1eb79d2de6c4 h1:NK3O7S5FRD/wj7ORQ5C3Mx1STpyEMuFe+/F0Lakd1Nk=
+github.com/mb0/glob v0.0.0-20160210091149-1eb79d2de6c4/go.mod h1:FqD3ES5hx6zpzDainDaHgkTIqrPaI9uX4CVWqYZoQjY=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/miekg/dns v1.1.58 h1:ca2Hdkz+cDg/7eNF6V56jjzuZ4aCAE+DbVkILdQWG/4=
@@ -364,6 +366,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/patrickdappollonio/kubectl-slice v1.4.2 h1:U1Jrma4BRK9D1Mbly8oP6uA06/gmOif6KjVQFrPUBzI=
+github.com/patrickdappollonio/kubectl-slice v1.4.2/go.mod h1:gt3IidcTPeCcazqcMuXF51VWU5mGsQv6YlNpXxQvPsE=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
@@ -404,8 +408,8 @@ github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsT
 github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/protocolbuffers/txtpbfmt v0.0.0-20250129171521-feedd8250727 h1:A8EM8fVuYc0qbVMw9D6EiKdKTIm1SmLvAWcCc2mipGY=
-github.com/protocolbuffers/txtpbfmt v0.0.0-20250129171521-feedd8250727/go.mod h1:VmWrOlMnBZNtToCWzRlZlIXcJqjo0hS5dwQbRD62gL8=
+github.com/protocolbuffers/txtpbfmt v0.0.0-20250627152318-f293424e46b5 h1:WWs1ZFnGobK5ZXNu+N9If+8PDNVB9xAqrib/stUXsV4=
+github.com/protocolbuffers/txtpbfmt v0.0.0-20250627152318-f293424e46b5/go.mod h1:BnHogPTyzYAReeQLZrOxyxzS739DaTNtTvohVdbENmA=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
@@ -439,10 +443,13 @@ github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
 github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.18.2 h1:LUXCnvUvSM6FXAsj6nnfc8Q2tp1dIgUfY9Kc8GsSOiQ=
 github.com/spf13/viper v1.18.2/go.mod h1:EKmWIqdnk5lOcmR72yw6hS+8OPYcwD0jteitLMVB+yk=
+github.com/spf13/viper v1.19.0 h1:RWq5SEjt8o25SROyN3z2OrDB9l7RPd3lwTWU8EcEdcI=
+github.com/spf13/viper v1.19.0/go.mod h1:GQUN9bilAbhU/jgc1bKs99f/suXKeUMct8Adx5+Ntkg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
@@ -456,8 +463,8 @@ github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOf
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/tetratelabs/wazero v1.6.0 h1:z0H1iikCdP8t+q341xqepY4EWvHEw8Es7tlqiVzlP3g=
-github.com/tetratelabs/wazero v1.6.0/go.mod h1:0U0G41+ochRKoPKCJlh0jMg1CHkyfK8kDqiirMmKY8A=
+github.com/tetratelabs/wazero v1.9.0 h1:IcZ56OuxrtaEz8UYNRHBrUa9bYeX9oVY93KspZZBf/I=
+github.com/tetratelabs/wazero v1.9.0/go.mod h1:TSbcXCfFP0L2FGkRPxHphadXPjo1T6W+CseNNY7EkjM=
 github.com/x-cray/logrus-prefixed-formatter v0.5.2 h1:00txxvfBM9muc0jiLIEAkAcIMJzfthRT6usrui8uGmg=
 github.com/x-cray/logrus-prefixed-formatter v0.5.2/go.mod h1:2duySbKsL6M18s5GU7VPsoEPHyzalCE06qoARUCeBBE=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
@@ -500,14 +507,14 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
-golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
+golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -517,18 +524,18 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
-golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
-golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
-golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
-golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -558,16 +565,16 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
-golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
-golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
+golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
+golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
-golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -575,8 +582,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.32.0 h1:Q7N1vhpkQv7ybVzLFtTjvQya2ewbwNDZzUgfXGqtMWU=
-golang.org/x/tools v0.32.0/go.mod h1:ZxrU41P/wAbZD8EDa6dDCa6XfpkhJ7HFMjHJXfBDu8s=
+golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
+golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
--- a/internal/cli/root.go
+++ b/internal/cli/root.go
@@ -17,6 +17,7 @@ import (

 	"github.com/holos-run/holos/internal/cli/command"
 	"github.com/holos-run/holos/internal/cli/render"
+	"github.com/holos-run/holos/internal/cli/slice"
 	"github.com/holos-run/holos/internal/cli/txtar"

 	cueCmd "cuelang.org/go/cmd/cue/cmd"
@@ -82,6 +83,9 @@ func New(cfg *holos.Config) *cobra.Command {
 	// Compile
 	rootCmd.AddCommand(NewCompileCmd())

+	// Slice - https://github.com/patrickdappollonio/kubectl-slice
+	rootCmd.AddCommand(slice.NewKubectlSliceCmd())
+
 	return rootCmd
 }

--- a/internal/cli/slice/doc.go
+++ b/internal/cli/slice/doc.go
@@ -0,0 +1,22 @@
+// MIT License
+
+// Copyright (c) 2021 Patrick D'appollonio
+
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+package slice
--- a/internal/cli/slice/slice.go
+++ b/internal/cli/slice/slice.go
@@ -0,0 +1,212 @@
+package slice
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/patrickdappollonio/kubectl-slice/slice"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"github.com/spf13/viper"
+)
+
+var version = "development"
+
+const (
+	helpShort = "kubectl-slice allows you to split a YAML into multiple subfiles using a pattern."
+
+	helpLong = `kubectl-slice allows you to split a YAML into multiple subfiles using a pattern.
+For documentation, available functions, and more, visit: https://github.com/patrickdappollonio/kubectl-slice.`
+)
+
+var examples = []string{
+	"kubectl-slice -f foo.yaml -o ./ --include-kind Pod,Namespace",
+	"kubectl-slice -f foo.yaml -o ./ --exclude-kind Pod",
+	"kubectl-slice -f foo.yaml -o ./ --exclude-name *-svc",
+	"kubectl-slice -f foo.yaml --exclude-name *-svc --stdout",
+	"kubectl-slice -f foo.yaml --include Pod/* --stdout",
+	"kubectl-slice -f foo.yaml --exclude deployment/kube* --stdout",
+	"kubectl-slice -d ./ --recurse -o ./ --include-kind Pod,Namespace",
+	"kubectl-slice -d ./ --recurse --stdout --include Pod/*",
+	"kubectl-slice --config config.yaml",
+}
+
+func generateExamples([]string) string {
+	var s bytes.Buffer
+	for pos, v := range examples {
+		s.WriteString(fmt.Sprintf("  %s", v))
+
+		if pos != len(examples)-1 {
+			s.WriteString("\n")
+		}
+	}
+
+	return s.String()
+}
+
+func NewKubectlSliceCmd() *cobra.Command {
+	opts := slice.Options{}
+	var configFile string
+
+	rootCommand := &cobra.Command{
+		Use:           "kubectl-slice",
+		Short:         helpShort,
+		Long:          helpLong,
+		Version:       version,
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		Example:       generateExamples(examples),
+
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			return bindCobraAndViper(cmd, configFile)
+		},
+
+		RunE: func(cmd *cobra.Command, args []string) error {
+			// Bind to the appropriate stdout/stderr
+			opts.Stdout = cmd.OutOrStdout()
+			opts.Stderr = cmd.ErrOrStderr()
+
+			// If no input file has been provided or it's "-", then
+			// point the app to stdin
+			if (opts.InputFile == "" || opts.InputFile == "-") && opts.InputFolder == "" {
+				opts.InputFile = os.Stdin.Name()
+
+				// Check if we're receiving data from the terminal
+				// or from piped content. Users from piped content
+				// won't see this message. Users that might have forgotten
+				// setting the flags correctly will see this message.
+				if !opts.Quiet {
+					if fi, err := os.Stdin.Stat(); err == nil && fi.Mode()&os.ModeNamedPipe == 0 {
+						fmt.Fprintln(opts.Stderr, "Receiving data from the terminal. Press CTRL+D when you're done typing or CTRL+C")
+						fmt.Fprintln(opts.Stderr, "to exit without processing the content. If you're seeing this by mistake, make")
+						fmt.Fprintln(opts.Stderr, "sure the command line flags, environment variables or config file are correct.")
+					}
+				}
+			}
+
+			// Create a new instance. This will also perform a basic validation.
+			instance, err := slice.New(opts)
+			if err != nil {
+				return fmt.Errorf("validation failed: %w", err)
+			}
+
+			return instance.Execute()
+		},
+	}
+
+	rootCommand.Flags().StringVarP(&opts.InputFile, "input-file", "f", "", "the input file used to read the initial macro YAML file; if empty or \"-\", stdin is used (exclusive with --input-folder)")
+	rootCommand.Flags().StringVarP(&opts.InputFolder, "input-folder", "d", "", "the input folder used to read the initial macro YAML files (exclusive with --input-file)")
+	rootCommand.Flags().StringSliceVar(&opts.InputFolderExt, "extensions", []string{".yaml", ".yml"}, "the extensions to look for in the input folder")
+	rootCommand.Flags().BoolVarP(&opts.Recurse, "recurse", "r", false, "if true, the input folder will be read recursively (has no effect unless used with --input-folder)")
+	rootCommand.Flags().StringVarP(&opts.OutputDirectory, "output-dir", "o", "", "the output directory used to output the splitted files")
+	rootCommand.Flags().StringVarP(&opts.GoTemplate, "template", "t", slice.DefaultTemplateName, "go template used to generate the file name when creating the resource files in the output directory")
+	rootCommand.Flags().BoolVar(&opts.DryRun, "dry-run", false, "if true, no files are created, but the potentially generated files will be printed as the command output")
+	rootCommand.Flags().BoolVar(&opts.DebugMode, "debug", false, "enable debug mode")
+	rootCommand.Flags().BoolVarP(&opts.Quiet, "quiet", "q", false, "if true, no output is written to stdout/err")
+	rootCommand.Flags().StringSliceVar(&opts.IncludedKinds, "include-kind", nil, "resource kind to include in the output (singular, case insensitive, glob supported)")
+	rootCommand.Flags().StringSliceVar(&opts.ExcludedKinds, "exclude-kind", nil, "resource kind to exclude in the output (singular, case insensitive, glob supported)")
+	rootCommand.Flags().StringSliceVar(&opts.IncludedNames, "include-name", nil, "resource name to include in the output (singular, case insensitive, glob supported)")
+	rootCommand.Flags().StringSliceVar(&opts.ExcludedNames, "exclude-name", nil, "resource name to exclude in the output (singular, case insensitive, glob supported)")
+	rootCommand.Flags().StringSliceVar(&opts.Included, "include", nil, "resource name to include in the output (format <kind>/<name>, case insensitive, glob supported)")
+	rootCommand.Flags().StringSliceVar(&opts.Excluded, "exclude", nil, "resource name to exclude in the output (format <kind>/<name>, case insensitive, glob supported)")
+	rootCommand.Flags().BoolVarP(&opts.StrictKubernetes, "skip-non-k8s", "s", false, "if enabled, any YAMLs that don't contain at least an \"apiVersion\", \"kind\" and \"metadata.name\" will be excluded from the split")
+	rootCommand.Flags().BoolVar(&opts.SortByKind, "sort-by-kind", false, "if enabled, resources are sorted by Kind, a la Helm, before saving them to disk")
+	rootCommand.Flags().BoolVar(&opts.OutputToStdout, "stdout", false, "if enabled, no resource is written to disk and all resources are printed to stdout instead")
+	rootCommand.Flags().StringVarP(&configFile, "config", "c", "", "path to the config file")
+	rootCommand.Flags().BoolVar(&opts.AllowEmptyKinds, "allow-empty-kinds", false, "if enabled, resources with empty kinds don't produce an error when filtering")
+	rootCommand.Flags().BoolVar(&opts.AllowEmptyNames, "allow-empty-names", false, "if enabled, resources with empty names don't produce an error when filtering")
+	rootCommand.Flags().BoolVar(&opts.IncludeTripleDash, "include-triple-dash", false, "if enabled, the typical \"---\" YAML separator is included at the beginning of resources sliced")
+	rootCommand.Flags().BoolVar(&opts.PruneOutputDir, "prune", false, "if enabled, the output directory will be pruned before writing the files")
+	rootCommand.Flags().BoolVar(&opts.RemoveFileComments, "remove-comments", false, "if enabled, comments generated by the app are removed from the sliced files (but keep comments from the original file)")
+	rootCommand.Flags().StringSliceVar(&opts.IncludedGroups, "include-group", nil, "resource kind to include in the output (singular, case insensitive, glob supported)")
+	rootCommand.Flags().StringSliceVar(&opts.ExcludedGroups, "exclude-group", nil, "resource kind to exclude in the output (singular, case insensitive, glob supported)")
+	_ = rootCommand.Flags().MarkHidden("debug")
+	return rootCommand
+}
+
+// envVarPrefix is the prefix used for environment variables.
+// Using underscores to ensure compatibility with the shell.
+const envVarPrefix = "KUBECTL_SLICE"
+
+// skippedFlags is a list of flags that are not bound through
+// Viper. These include things like "help", "version", and of
+// course, "config", since it doesn't make sense to say where
+// the config file is located in the config file itself.
+var skippedFlags = [...]string{
+	"help",
+	"version",
+	"config",
+}
+
+// bindCobraAndViper binds the settings loaded by Viper
+// to the flags defined in Cobra.
+func bindCobraAndViper(cmd *cobra.Command, configFileLocation string) error {
+	v := viper.New()
+
+	// If a configuration file has been passed...
+	if cmd.Flags().Lookup("config").Changed {
+		// ... then set it as the configuration file
+		v.SetConfigFile(configFileLocation)
+
+		// then read the configuration file
+		if err := v.ReadInConfig(); err != nil {
+			return fmt.Errorf("failed to read configuration file: %w", err)
+		}
+	}
+
+	// Handler for potential error
+	var err error
+
+	// Recurse through all the variables
+	cmd.Flags().VisitAll(func(flag *pflag.Flag) {
+		// Skip the flags that are not bound through Viper
+		for _, v := range skippedFlags {
+			if v == flag.Name {
+				return
+			}
+		}
+
+		// Normalize key names with underscores instead of dashes
+		nameUnderscored := strings.ReplaceAll(flag.Name, "-", "_")
+		envVarName := strings.ToUpper(fmt.Sprintf("%s_%s", envVarPrefix, nameUnderscored))
+
+		// Bind the flag to the environment variable
+		if val, found := os.LookupEnv(envVarName); found {
+			v.Set(nameUnderscored, val)
+		}
+
+		// If the CLI flag hasn't been changed, but the value is set in
+		// the configuration file, then set the CLI flag to the value
+		// from the configuration file
+		if !flag.Changed && v.IsSet(nameUnderscored) {
+			// Type check for all the supported types
+			switch val := v.Get(nameUnderscored).(type) {
+
+			case string:
+				_ = cmd.Flags().Set(flag.Name, val)
+
+			case []interface{}:
+				var stringified []string
+				for _, v := range val {
+					stringified = append(stringified, fmt.Sprintf("%v", v))
+				}
+				_ = cmd.Flags().Set(flag.Name, strings.Join(stringified, ","))
+
+			case bool:
+				_ = cmd.Flags().Set(flag.Name, fmt.Sprintf("%t", val))
+
+			case int:
+				_ = cmd.Flags().Set(flag.Name, fmt.Sprintf("%d", val))
+
+			default:
+				err = fmt.Errorf("unsupported type %T for flag %q", val, nameUnderscored)
+				return
+			}
+		}
+	})
+
+	// If an error occurred, return it
+	return err
+}
--- a/internal/helm/helm.go
+++ b/internal/helm/helm.go
@@ -3,11 +3,13 @@ package helm
 import (
 	"context"
 	"fmt"
+	"net/url"

 	"github.com/holos-run/holos/internal/errors"
 	"github.com/holos-run/holos/internal/logger"
 	"helm.sh/helm/v3/pkg/action"
 	"helm.sh/helm/v3/pkg/cli"
+	"helm.sh/helm/v3/pkg/registry"
 )

 // PullChart downloads and caches a Helm chart locally. It handles both OCI and
@@ -32,6 +34,20 @@ func PullChart(ctx context.Context, settings *cli.EnvSettings, chartRef, chartVe
 	}
 	actionConfig.RegistryClient = registryClient

+	chartRefURL, err := url.Parse(chartRef)
+	if err != nil {
+		return errors.Format("Failed to parse the Chart: %w", err)
+	}
+
+	// If the chart been pulled is an OCI chart, the repo authentication has to be done ahead of the pull.
+	if chartRefURL.Scheme == "oci" && username != "" && password != "" {
+		loginOption := registry.LoginOptBasicAuth(username, password)
+		err = registryClient.Login(chartRefURL.Host, loginOption)
+		if err != nil {
+			return errors.Format("failed to login to registry: %w", err)
+		}
+	}
+
 	pullClient := action.NewPullWithOpts(action.WithConfig(actionConfig))
 	pullClient.Untar = true
 	pullClient.RepoURL = repoURL
--- a/version/embedded/minor
+++ b/version/embedded/minor
@@ -1 +1 @@
-104
+105
Author	SHA1	Message	Date
Jeff McCune	3d696b958b	version 0.105.1 fixes oci chart auth (#447 )	2025-09-25 07:12:41 -07:00
Jeff McCune	1bf627b5e1	Merge pull request #447 from manrueda/feat-oci-chart-authentication Allows authentication of OCI charts	2025-09-25 07:08:13 -07:00
Manuel Rueda	df69198cef	allows authentication of OCI charts	2025-09-25 09:52:38 -04:00
Jeff McCune	810a7c6649	version 0.105.0 with kubectl-slice	2025-09-24 20:58:09 -07:00
Jeff McCune	b24e35f46d	add kubectl-slice subcommand It's really good at filtering resources like Namespace, Secret, and CustomResourceDefinition. It's excellent at breaking up files into an easy to navigate, clear structure that integrates well with tools. fzf for example.	2025-09-24 20:46:49 -07:00
Jeff McCune	22c65bbc6c	add ca-certificates to container image for git Without this patch git fails to pull from https remotes.	2025-09-01 06:45:58 -07:00
Jeff McCune	e913ce6368	Merge pull request #444 from WhyKickAmooCow/patch-1 Add ca-certificates to container image	2025-09-01 06:43:31 -07:00
Adam	0abfa660d0	Add ca-certificates to container image Signed-off-by: Adam <WhyKickAmooCow@users.noreply.github.com>	2025-09-01 23:20:39 +12:00
Jeff McCune	8883a89c44	bump cue to v0.14.1 from v0.13.0-rc.1 Commands to update the tests and website docs to the new version: make bump make update-docs	2025-08-31 15:51:35 -07:00
Jeff McCune	b4d8794e23	container: update to debian 13 and install git Update to kubectl v1.33.4 Closes: #440	2025-08-31 15:51:34 -07:00
@@ -1 +1 @@
 .104.1
 .105.0